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I.  INTRODUCTION 


The  events  that  occurred  on  September  11,  2001  changed  many  things 
about  life  in  America.  While  terrorists,  both  domestic  and  international,  had 
committed  acts  of  terrorism  in  the  United  States  prior  to  9/11;  on  that  day 
everyone  knew  that  these  attacks  signified  something  different.  That  day  there 
were  no  doubts  to  the  resolve,  creativity  and  capability  of  the  enemy.  Many 
questioned,  at  the  time,  the  identity  of  the  enemy  but  no  one  questioned  the  fact 
that  an  enemy  existed  and  they  were  attacking  us  in  our  own  backyard. 

One  particular  change  about  life  in  America  since  9/1 1  is  the  subject  of 
this  thesis,  the  need  for  government  officials  at  all  levels  to  have  accurate,  timely, 
and  exhaustive  intelligence  information.  The  intelligence  community  is  the 
system  that  collects,  develops  and  analyzes  information  that  can  be  used  to 
identify  and  defeat  our  terrorist  enemies.  That  system  must  now  be  repaired. 
The  very  system  that  is  not  only  responsible  for  developing,  collecting,  analyzing 
but  also  for  sharing  intelligence  information,  failed  on  9/11.  One  of  the  reasons 
for  that  failure  was  the  virtual  exclusion  of  input  from  state  and  local  law 
enforcement  into  that  system.  On  that  tragic  day  foreign-initiated  acts  of 
terrorism  occurred  in  America.  Not  against  American  interests  in  Yemen,  Kabul 
or  Beirut  but  in  cities  and  states  in  the  homeland  of  the  United  States  of  America. 
The  attacks  were  not  state  sponsored  military  offensive  maneuvers  utilizing 
military  forces  and  weaponry,  but  were  instead  offensive  maneuvers  by  terrorists 
who  were  living  here,  planning  here  and  operating  under  the  radar  screen  of  the 
established  intelligence  community.  The  intelligence  community  had  previously 
failed  with  both  international  and  domestic  attacks,  but  since  9/1 1  solutions  are 
being  demanded.  This  thesis  offers  a  solution. 

A.  PURPOSE 

The  purpose  of  this  thesis  is  not  to  try  and  solve  each  and  every  issue  or 
problem  that  exists  within  the  intelligence  community.  The  purpose  of  this  thesis 
is  to  prove  is  that  state  and  local  governments  have  a  key  role  to  play  in  the 

system  we  refer  to  as  the  intelligence  community.  Further,  this  thesis  will  show 
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that  not  only  do  state  and  local  governments  need  information  from  the 
intelligence  community  but  the  intelligence  community  desperately  needs 
information  from  state  and  local  governments.  Additionally,  this  thesis  will 
describe  the  requirements  that  are  necessary  for  a  successful  state  level 
Information  Sharing  and  Analysis  Center  (ISAC)  effort.  The  final  point  of  the 
thesis  is  to  show  the  important  organizational  features  of  a  state  ISAC.  To 
describe  how  the  Georgia  ISAC  (GISAC)  was  created  the  successes  it  has  had 
and  through  case  studies  highlight  important  points,  successes  and  challenges 
faced  by  states  in  their  effort  to  develop  ISACs.  All  in  order  to  give  other  states  a 
solution  and  a  model  to  consider  when  developing  state  level  intelligence 
capabilities.  Today  each  state  needs  this  capability  and  the  federal  intelligence 
community  needs  the  input  of  the  fifty  states.  The  author’s  argument  is  that  the 
current  intelligence  system  has  failed  and  it  is  necessary  for  states  to  develop 
information  collection,  sharing  and  analysis  capabilities  to  do  their  part  in  the  fight 
against  terrorism.  States  have  a  significant  role  in  terrorism  prevention  in  the 
homeland  security  context.  As  Secretary  Tom  Ridge  has  stated,  “If  we  secure 
the  hometowns,  we  will  secure  the  homeland.”1 
B.  IMPORTANCE 

We  now  know  that  not  only  are  domestic  terrorists  living  in  our 
communities  but  international  terrorists  as  well  and  it  is  from  our  own 
neighborhoods  in  which  they  are  staging  their  attacks.  Of  course,  we  know  the 
nineteen  Al  Qaeda  hijackers  from  9/1 1  were  living  in  the  United  States,  but  do 
not  think  that  those  nineteen  were  an  anomaly  or  represent  some  temporary  hole 
in  the  immigration  system.  Nor  should  you  think  that  Al  Qaeda  is  the  only 
international  terrorist  organization  represented  in  our  homeland.  Consider  the 
case  recently  prosecuted  in  North  Carolina  where  nineteen  people,  all  operatives 
of  Hezbollah,  were  convicted  of  money  laundering  and  smuggling  money  back  to 
the  Middle  East  for  support  of  terrorism.  Additionally  consider  the  statement  of 
U.S.  Attorney  Robert  Conrad,  "I  believe  that  if  there  is  a  Hezbollah  terrorist  cell  in 

1  Don  Plummer  and  Rebecca  Carr.  “U.S.  Still  Donning  Security  Armor”.  The  Atlanta  Journal- 
Constitution.  12  May  2002. 
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Charlotte,  then  there  are  similar  cells  elsewhere."2 3  There  is  ample,  actually 
plentiful,  evidence  that  there  are  various  terrorists  (both  international  and 
domestic)  and  those  who  provide  material  support  to  terrorist  organizations  living 
in  the  United  States.  If  the  people  who  seek  to  destroy  us  are  living  among  us 
then  we  cannot  rely  solely  on  some  foreign  legal  attache  or  upon  some  signals 
intelligence  source  aimed  at  a  safe-house  in  a  country,  of  which  most  of  us  can 
not  properly  pronounce  the  name,  to  provide  all  of  our  intelligence  information. 
We  must  consider  the  abundance  and  critical  nature  of  the  information  that  is 
available  at  the  state  and  local  government  level.  By  the  way,  the  information  that 
initiated  the  investigation  into  the  Hezbollah  cell  in  North  Carolina  was  provided 
by  an  alert  local  Sheriffs  deputy.  He  was  off  duty  one  day  and  noticed  a  young 
Middle  Eastern  man  buying  large  quantities  of  cigarettes  with  cash  and  reported 
the  information  to  the  authorities. 

C.  A  SOLUTION 

Not  only  do  state  and  local  governments  need  to  be  allowed  ingress  and 
egress  into  the  intelligence  community.  There  must  be  a  mechanism  to  allow  for 
that  access.  The  State  of  Georgia  has  created  such  a  mechanism  that  has 
proven  to  be  both  effective  and  efficient  in  accomplishing  that  mission.  In 
October  of  2001  the  Georgia  Information  Sharing  and  Analysis  Center  (GISAC) 
was  created  as  that  state’s  first  effort  at  preventive  efforts  toward  terrorism. 
There  were  several  goals  for  GISAC  initially;  establish  a  central  organization 
where  local  governments  could  deposit  pieces  of  information  they  thought  to  be 
suspicious  relating  to  potential  terrorism;  create  a  liaison  with  the  federal 
government’s  intelligence  community  through  the  FBI  and  to  facilitate  the  sharing 
of  any  pertinent  information  with  local  and/or  federal  agencies  as  needed. 

For  many  years  local,  state  and  even  federal  law  enforcement  intelligence 
efforts  have  been  focused  on  traditional  criminal  intelligence  activities  including 
organized  crime  and  drug  trafficking;  international  terrorism  was  something  to  be 
handled  by  the  military  or  the  Central  Intelligence  Agency.  For  some  reason 


2  Toni  Locy.  “U.S.  Looks  at  Potential  Danger  From  Hezbollah”.  USA  Today.  14  May  2003. 
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it  appeared  to  be  the  conventional  wisdom  that  in  America,  until 
recently,  terrorism  was  infrequent  and  unimportant.  In  fact,  in  the 
past  half-century,  the  United  States  has  experienced  a  significant 
amount  of  terrorism.3 

Today  we  are  again  reminded  that  terrorists,  both  international  and 
domestic,  are  living  on  American  soil  and  history  tells  us  that  America  is 
vulnerable  to  those  terrorists.4  Now,  with  the  spotlight  of  9/1 1  on  the  failure  of 
the  intelligence  community,  we  must  enlist  and  include  the  valuable  contributions 
that  state/local  governments  can  provide  to  the  intelligence  system. 

The  GISAC  is  nearly  three  years  old  and  has  enjoyed  tremendous 
success.  The  organization  has  been  recognized  by  the  National  Governor’s 
Association  as  part  of  a  state  contingent  invited  to  participate  in  a  Policy 
Academy  for  Best  Practices  in  Homeland  Security  in  2002.  GISAC  has  also 
been  involved  in  many  successful  and  high  profile  cases  and  investigations  that 
have  contributed  to  the  overall  intelligence  effort  in  our  country.  In  addition,  the 
organization  is  currently  breaking  new  ground  by  participating  as  a  co  lead 
agency  (with  the  FBI)  in  the  intelligence  operations  for  the  upcoming  Group  of 
Eight  Summit  (G8)  to  be  held  on  Sea  Island,  Georgia  in  June  2004. 

D.  CHAPTER  BY  CHAPTER  SUMMARY 

One  particular  high  profile  case  occurred  in  September  2002  and  is 
referred  to  as  the  Alligator  Alley  case.  That  case,  summarized  in  Chapter  II, 
demonstrates  several  points  that  will  be  expanded  upon  throughout  this  paper; 
the  importance  of  local  inputs,  the  necessity  of  relationships  and  connectivity  with 
other  states  and  the  federal  government  and  the  viable  role  of  local  governments 
to  deny  terrorist  plots.  That  chapter  will  further  describe  the  requirements  of  an 
effective  information  sharing  system  that  is  a  necessary  addition  to  every  state 
and  to  the  intelligence  community. 


3  Christopher  Hewitt.  Understanding  Terrorism  In  America:  From  the  Klan  to  Al  Qaeda. 
London,  Routledge,  2003.  p.  12. 

4  Ibid.  Hewitt  asserts  between  1954  and  9/11  “well  over  3000  terrorists  incidents... have  taken 
place  within  the  United  States  and  Puerto  Rico... and  it  would  be  a  serious  misreading  of  the 
historical  record  to  see  terrorism  as  either  a  new  or  a  trivial  phenomenon  in  America.” 
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There  are  other  requirements  beyond  the  need  to  develop  a  system  that  is 
able  to  capture,  analyze  and  pass  along  the  information  from  the  hundreds  of 
thousands  of  local  law  enforcement  and  government  officials  working  in 
communities  every  day.  It  is  also  important  to  have  a  local  mechanism  to 
disseminate  the  strategic  intelligence  information  that  is  typically  developed  by 
the  federal  government.  The  State  of  Georgia  does  not,  and  it  is  doubtful  that  it 
ever  will,  develop  operatives  in  Afghanistan  or  dispatch  interrogators  to 
Guantanamo  Bay  to  gain  the  type  of  information  that  will  give  an  idea  of  the 
strategic  nature  of  the  enemy.  The  federal  government  does,  however,  and  the 
states  must  have  a  mechanism  for  receiving  that  information  and  providing  it  to 
state  level  policy  makers.  These  policy  makers  need  to  have  strategic 
intelligence  information  to  make  sound  resource  allocation  decisions  for  their  part 
in  the  homeland  security  mission. 

Further,  states  need  to  be  able  to  collect  and  disseminate  information  at 
the  tactical  intelligence  level.  If  the  collection  and  analysis  system  is  working 
properly  states  can  provide  valuable  pieces  of  information  to  the  federal 
government  who  is  in  the  position  to  “connect  the  dots”  from  a  regional  or 
national  perspective.  Depending  on  the  type  of  information,  states  often  can  take 
action  independently  when  an  impending  attack  is  discovered  or  if  plans  are 
discovered  that  do  not  have  regional  or  national  implications.  Several  cases 
studies  in  Chapter  III  highlight  examples  of  the  state  taking  action  on  information 
that  had  a  state  rather  than  a  national  impact. 

Chapter  III  begins  with  a  historical  documentation  of  GISAC  and  how  the 
unit  was  established,  why  it  is  successful,  the  challenges  that  unit  is  facing  and 
how  they  are  being  addressed  to  ensure  its  future  success.  Several  case  studies 
of  actual  events  are  used  to  accentuate  important  principles  and  show  that 
GISAC  is  an  effective  model  for  states  to  consider  when  designing  mechanisms 
for  access  into  the  intelligence  community. 
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Equally  important  this  chapter  discusses  key  relationships  of  GISAC  both 
internal  and  external  to  the  unit.  In  the  intelligence  community,  organizational 
and  personal  relationships  are  very  important  and  impact  the  flow  of  information. 

All  “wiring”  diagrams,  no  matter  how  sophisticated,  are  deceptive. 

They  portray  where  agencies  sit  in  relation  to  one  another,  but  they 
cannot  portray  how  they  interact  and  which  relationships  matter  and 
why.  Moreover,  although  we  are  loath  to  admit  it,  personalities  do 
matter.  However  much  we  like  to  think  of  government  as  one  of 
laws  and  institutions,  the  personalities  and  relationships  of  the 
people  filling  these  important  positions  also  effect  agency  working 
relations.5 

One  of  the  most  important  relationships  for  GISAC  is  the  one  established 
with  the  FBI  and  the  Joint  Terrorism  Task  Force  (JTTF)  operated  out  of  their 
Atlanta  office.  That  relationship  was  formed  and  eventually  GISAC  moved  into 
the  same  building  and  only  one  floor  separates  the  two  entities.  As  the  unit 
matured  various  capabilities  and  products  to  support  state  policy  makers  were 
developed  and  enhanced.  Some  of  these  capabilities  have  their  roots  in  the 
criminal  intelligence  realm  while  some  have  been  developed  specifically  since 
9/1 1  to  fight  the  war  on  terror  at  home. 

Chapter  III  concludes  by  examining  challenges  GISAC  is  facing  in  light  of 
its  success  during  the  past  two  and  one  half  years.  Certain  sectors  of  critical 
infrastructure  are  beginning  to  develop  Information  Sharing  and  Analysis  Centers 
of  their  own.  The  challenge  is  to  encourage  their  development  for  the  sharing 
and  analytical  capability  but  to  maintain  its  centrality  of  all  intelligence  activities 
for  Georgia.  Success  has  also  created  high  expectations  for  the  unit  to  maintain. 
In  June  2004,  the  Group  of  Eight  Summit  will  be  held  at  Sea  Island,  Georgia  and 
GISAC  will  play  a  key  role  in  this  National  Security  Special  Event.  GISAC  and 
the  other  federal  partners  will  staff  a  fusion  center  and  GISAC  will  also  be  taking 
the  lead  role  in  staffing  and  commanding  the  field  intelligence  units. 


5  Mark  Lowenthal.  Intelligence:  From  Secrets  to  Policy,  2nd  ed.,  CQ  Press,  Washington, 
D.C.,  2003.  p.  30. 
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Chapter  IV  is  the  concluding  chapter  and  will  provide  a  concise  summary 
of  the  lessons  learned  and  the  evidence  supporting  the  position  offered  in  this 
thesis.  First,  the  intelligence  community  has  experienced  failures  in  both 
international  and  domestic  terrorism  attacks  conducted  in  America.  On  9/1 1 
failures  in  the  intelligence  community  were  amplified.  Second,  a  key  solution  to 
repairing  the  intelligence  community  is  to  include  state  and  local  intelligence 
efforts  into  the  broader  intelligence  community  effort.  This  inclusion  into  the 
broader  effort  benefits  both  federal  and  state/local  preparedness  and  prevention 
efforts.  Third,  requirements  of  successful  state  level  information,  sharing  and 
analysis  capabilities  are  examined.  These  requirements  are  discussed  in  the 
context  of  strategic  and  tactical  level  dimensions.  Beyond  those  dimensions,  the 
Alligator  Alley  case  study  reveals  several  fundamental  principles  that  all  state 
level  ISACs  must  incorporate  to  achieve  success.  Finally,  the  state  of  Georgia 
has  developed  an  organization  that  achieves  these  principles  and  provides  for 
the  intelligence  needs  of  both  state  and  federal  levels  of  governments.  GISAC  is 
a  model  useful  for  other  states  to  utilize  as  they  develop  this  capability. 

Indeed,  the  awful  events  of  9/11  changed  many  things  about  life  in 
America.  One  of  the  things  that  changed  in  Georgia  was  the  way  state  leaders 
decided  to  address  their  role  in  the  intelligence  community  and  their  role  in 
preventing  terrorism  on  a  local  level.  No  one  knew  at  the  time  whether  GISAC 
would  succeed  or  fail  or  what  exactly  their  mission  would  be.  After  deciding  that 
something  must  be  done,  the  state  requirements  for  successful  information 
sharing  and  intelligence  had  to  be  developed. 
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II.  REQUIREMENTS  FOR  EFFECTIVE  INFORMATION 
SHARING  AND  INTELLIGENCE  ON  THE  STATE  GOVERNMENT 

LEVEL 


It  is  easy,  and  today  quite  fashionable,  to  condemn  the  entire  intelligence 
community  for  the  failure  to  identify  the  plans  and  subsequently  thwart  the 
terrorist  attacks  perpetrated  by  members  of  Al  Qaeda  on  9/1 1 .  Enough  time  has 
passed  at  this  point  for  all  of  us  to  have  completed  our  cycle  of  emotions  (denial, 
rage,  attribution  and  revenge)  and  get  to  the  business  of  solving  the  problems 
made  manifest  by  the  attacks.  It  has  been  widely  reported  in  the  media  and 
thoroughly  examined  by  congressional  inquiry  that  while  the  exact  timing, 
location  and  method  of  the  attacks  were  a  surprise,  the  intention  that  Al  Qaeda 
wanted  to  further  harm  United  States  interests  was  not  a  surprise  at  all  to  certain 
members  of  the  intelligence  community.  The  assertion  that  bits  and  pieces  of 
information,  now  known  to  be  significant  regarding  the  attacks,  could  have  been 
assembled  to  uncover  the  plot  to  kill  thousands  of  Americans  may  never  be  fully 
conclusive. 

While  the  attacks  on  9/1 1  have  certainly  brought  to  the  forefront  the 
problems  within  the  intelligence  community,  the  United  States  is  no  stranger  to 
successful  acts  of  terrorism.  The  same  terrorist  organization  of  9/1 1,  Al  Qaeda, 
was  responsible  for  the  first  attack  on  the  World  Trade  Center  in  1993.  More 
numerous,  however,  are  domestic  terrorists  who  have  been  successful  in 
conducting  many  violent  and  disruptive  acts.  Timothy  McVeigh,  committed  one 
of  the  most  deadly  terrorists  attacks  ever  in  the  United  States  by  bombing  the 
Alfred  P.  Murrah  Federal  Building  in  Oklahoma  City  killing  168.  Eric  Robert 
Rudolf,  one  of  the  most  elusive  domestic  terrorists,  bombed  abortion  clinics  and 
disrupted  the  Centennial  Olympic  Games  by  detonating  a  bomb  in  Centennial 
Olympic  Park  killing  two  and  injuring  103  people.  These  are  but  a  few  examples 
of  the  numerous  acts  of  terrorism  that  have  been  committed  in  the  homeland. 
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While  blame  and  vindication  may  be  important  to  some,  the  important 
work,  I  believe,  is  to  examine  what  went  wrong  and  repair  those  problems. 
These  constructive  actions  will  be  what  minimize  the  chances  of  a  similar 
“failures”  from  occurring  again. 

The  task  of  reengineering  the  intelligence  community  is  huge  and  must  be 
tackled  by  think  tanks  and  task  forces  vast  enough  to  meet  the  challenge.  There 
were  “intelligence  failures”  and  ultimately  the  attacks  on  9/1 1  were  not  prevented. 
The  intelligence  community  and  the  system  by  which  intelligence  and  information 
is  collected,  analyzed  and  shared  must  be  reengineered  to  incorporate  the 
lessons  we  have  learned.  One  of  those  lessons  is  that  state  and  local 
governments  have  a  very  important  role  to  play  and  have  very  high  stakes  in  the 
success  of  that  system.  What  this  thesis  will  do  is  examine  but  one  very  narrow 
component  of  that  reengineering  necessity,  the  role  of  state  and  local 
governments  in  the  intelligence  community  and  the  way  the  State  of  Georgia  has 
positioned  itself  to  make  a  contribution  to  that  effort.  More  specifically,  however, 
this  chapter  is  devoted  to  outlining  the  important  requirements  necessary  for 
effective  information  sharing  and  intelligence  dissemination  to  occur  at  the  state 
and  local  levels. 

The  Markle  Foundation  Task  Force  Report  addressed  the  organizational 
challenges  necessary  to  restructure  the  intelligence  community  for  the  effective 
collection  and  use  of  local  information. 

The  first  step  should  be  to  focus  on  how  information  from  state  and 
localities,  which  is  so  crucial  to  the  homeland  security  effort,  can 
reach  those  in  the  federal  government  who  need  to  act  on  it,  and 
how  the  federal  government’s  information  can  reach  those  on  the 
front  line.  To  be  effective  at  collecting  and  using  all  relevant 
information,  the  entire  national  system  must  work  like  a  network, 
coordinated  at  the  federal  level  but  controlled  locally.  Two  concrete 
steps  can  help  start  this  process.  First,  states  must  begin 
organizing  themselves  to  gather  and  share  information  more 
effectively.  Second,  the  federal  government  needs  one  entity 
responsible  for  coordinating  its  role  in  this  effort.6 

6  Protecting  America’s  Freedom  in  the  Information  Age:  A  Report  of  the  Markle  Foundation 
Task  Force.  October  2002.  New  York.  p.  75. 
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Regarding  antiterrorism  intelligence  requirements,  state  and  local 
governments’  demands  do  not  differ  significantly  from  those  of  the  federal 
agencies  combating  terrorism  inside  of  the  United  States.  Each  covets  strategic 
and  tactical  intelligence,  in  addition  the  states  need  a  single  point  of  contact  with 
(or  ingress  into)  the  federal  system  and  must  have  the  capability  to  provide 
intelligence  to  their  policy  makers.  Here  will  be  discussed  the  needs  and 
interrelationships  necessary  for  each  level  of  government  to  meet  the 
requirements  for  counterterrorism  in  the  homeland,  to  contribute  and  benefit  from 
a  reengineered  system. 

A.  STRATEGIC  INTELLIGENCE  IN  THE  HOMELAND 

The  battles  of  terrorism  are  being  fought  both  at  home  and  abroad. 
Naturally,  the  definitions  of  strategic  and  tactical  intelligence  are  somewhat 
different  between  local/state,  some  federal  government  agencies  and  military 
organizations.  The  line  of  demarcation  is  not  drawn  based  upon  the  level  of 
government  that  is  involved  in  a  particular  operation  or  intelligence  product  but 
rather  where  the  battle  is  being  fought,  at  home  or  abroad.  Mark  Lowenthal 
offers  the  following  goal  for  the  intelligence  community  regarding  strategic 
surprise,  “keep  track  of  threats,  forces,  events,  and  developments  that  are 
capable  of  threatening  the  nation’s  existence.”7  When  a  country,  through  its 
intelligence  community  keeps  track  of  these  types  of  elements  it  precludes 
strategic  surprise.  For  example,  if  a  country  is  attacked  with  a  nuclear  device 
when  there  has  been  no  indication  or  information  that  any  countries  possessed  a 
nuclear  device.  Conversely,  if  a  country  has  knowledge  of  a  specific  capability 
possessed  by  a  potential  enemy  that  country  can  prepare  to  deny  or  respond  to 
that  specific  capability  or  threat.  This  type  of  information  and  intelligence  allows 
policy  makers  to  make  choices  with  regard  to  budgetary  expenditures,  defensive 
and  preparedness  activities.  In  the  homeland  security  context,  strategic 
intelligence  is  similar  and  directly  supports  detection,  denial,  disruption  and 
preparedness  efforts  of  the  entities  fighting  the  battle  at  home.  Since  the  enemy 

7  Mark  Lowenthal.  Intelligence:  From  Secrets  to  Policy,  2nd  ed.  CQ  Press,  Washington.  2003. 

p.  2. 
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is  living,  planning  and  operating  within  the  boundaries  of  our  country  those 
responsible  for  fighting  them  must  know  what  threats  and  capabilities  exist  with 
the  enemy. 

Starting  with  the  federal  budget  cycle  of  2002  billions  of  dollars  are  being 
spent  on  state  and  local  preparedness  efforts  alone.  It  only  makes  sense  for 
those  state  and  local  first  responders  to  be  provided  the  strategic  intelligence  that 
will  shape  their  training  and  preparedness  efforts.  What  is  the  capability  of  the 
enemy?  What  are  the  types  of  attacks  that  they  will  plan  next?  It  is  senseless  to 
prepare  for  a  method  of  attack  that  will  never  occur  but  shameful  to  fail  to 
prepare  for  an  attack  that  has  been  predicted.  Even  more  shameful  is  if  the 
prediction,  or  capabilities  of  the  enemy,  was  never  shared  with  those  who  could 
prevent  it  or  may  have  to  respond  to  its  consequences.  The  moral  obligation  not 
withstanding,  the  fiscal  oversight  alone  should  demand  that  our  capacity  to 
prevent  and  respond  is  being  built  based  upon  accurate  information. 

To  state  and  local  governments  the  strategic  intelligence  answers  the 
questions  of  capability  and  intent.  Would  the  enemy  attack  at  a  sporting  event,  a 
mall  or  a  mass  transit  venue?  Or  does  the  enemy  prefer  to  strike  the  electrical 
power  grid,  petroleum  transmission  pipelines  or  telecommunications  hubs?  Is 
their  desire  mass  casualties,  mass  disruption,  or  mass  confusion?  Once  intent 
and  possibly  the  method  of  operation  is  established  then  the  question  is  can  they 
do  it?  Does  the  enemy  have  the  capability  to  act  out  their  intentions  by  the 
methods  they  choose?  What  does  history  tell  us,  and  has  this  enemy  attempted 
this  type  of  attack  before  and  what  were  the  results?  These  are  the  questions 
and  types  of  information  or  strategic  intelligence  that  state  and  local  governments 
need  in  their  preparedness  and  fight  against  terrorism.  With  limited  resources 
and  an  unlimited  number  of  potential  targets  and  methods  of  attack,  strategic 
intelligence  is  a  necessary  requirement  for  state  and  local  counterterrorism 
efforts. 
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B.  TACTICAL  INTELLIGENCE  IN  THE  HOMELAND 

Since  the  enemy,  or  least  some  number  of  the  enemy’s  operatives  are 
living  in  the  cities  and  neighborhoods  in  America,  who  is  best  positioned  to  be  the 
eyes  and  ears  of  the  Intelligence  Community?  The  answer  is  the  hundreds  of 
thousands  of  local  and  state  officials  that  are  working  in  those  communities  24 
hours  a  day  seven  days  per  week.  One  can  then  add  to  that  number  the  untold 
number  of  workers  in  industries  regulated  by  state  and  local  governments  that 
have  regular,  mandatory  reporting  requirements  to  those  authorities.  Regardless 
of  whether  the  strategic  intelligence  indicates  that  the  enemy  is  desirous  of  an 
attack  on  critical  infrastructure,  key  assets  or  venues  congregating  thousands  of 
people  in  one  place,  local  and  state  officials  have  access  to  those  local 
information  sources  to  report  and/or  develop  the  tactical  intelligence. 

Tactical  intelligence  in  the  homeland  security  environment  is  more  specific 
and  when  combined  with  other  pieces  of  information  may  reveal  plans  of  attack, 
methods  of  attack  or  the  location  of  terrorist  cells  in  a  community.  With  this  kind 
of  intelligence  reported  from  countless  local  and  state  sources,  federal  agencies 
can  “connect  the  dots”  on  a  regional  and  national  level,  while  state  level 
intelligence  organizations  can  piece  together  information  that  may  not  have  as  far 
reaching  impacts. 

The  following  case  study  shows  that  the  specific  or  tactical  level 
intelligence  most  often  will  be  reported  and  developed  at  the  local  and  state  level. 
The  strategic  intelligence  however  was  arguably  provided  by  the  federal 
government  in  the  form  of  a  raised  threat  level  and  statements  by  U.S.  officials 
that  Al  Qaeda  operatives  were  in  America  subsequent  to  the  attacks  of  9/1 1 . 
Additionally,  the  case  study  shows  the  necessity  for  a  single  point  of  contact  for 
the  federal  government,  a  single  point  of  contact  for  other  state  resources  and 
why  states  need  capability  to  conduct  their  own  intelligence  operations.  The 
case  is  known  as  Alligator  Alley  and  it  happened  exactly  one  year  after  the  tragic 
events  of  9/1 1 . 
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C.  ALLIGATOR  ALLEY 

During  the  period  of  September  12-13,  2002  the  states  of  Georgia  and 
Florida  became  involved  in  what  was  to  be  one  of  the  most  highly  publicized  and 
highly  controversial  “terror  alerts”  that  has  occurred  since  the  war  on  terrorism 
began  September  11,  2001. 8  At  11:10  a.m.  on  September  12,  2002  a  telephone 
call  was  forwarded  to  an  agent  of  the  Georgia  Information  Sharing  and  Analysis 
Center  (GISAC)  by  the  Calhoun  Post  of  the  Georgia  State  Patrol.  The  caller  was 
a  middle  aged  nurse,  Eunice  Stone,  who  reported  to  the  agent  that  she  and  her 
son,  just  twenty  minutes  earlier,  had  left  the  Shoney’s  restaurant  at  Interstate  75 
and  Redbud  Road  in  Calhoun,  GA  where  she  overheard  the  conversation  of 
three  “Middle  Eastern  males”  that  gave  her  cause  for  concern. 


8  The  following  account  is  based  on  press  coverage,  including  in  particular  the  articles  cited. 
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Social  Science  Perspective  and  State-of-the-Art  Assessment.  Prepared  for  the  Federal 
Emergency  Management  Agency  by  the  Oak  Ridge  National  Laboratory.  Oak  Ridge,  Tennessee, 
August  1990. 

“Eunice  Stone’s  conversation  this  morning  with  Fox  News.”  Calhoun  Times,  13  September 
2002.  Available  from 

http://news.mywebpal.com/news  tool  v2.cfm?pnpid=722&show=archivedetails&ArchivelD=8569 

70&om=1 .  Accessed  26  April  2003. 

“Man  in  Terror  Scare  says  Woman  is  Lying.”  CNN.com/U.S.,  13  September  2002.  Available 
from  http://www.cnn.com/2002/US/09/13/alliqator.alley/.  Accessed  3  February  2003. 
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Stone  reported  that  she  and  her  son  were  seated  in  the  restaurant 
adjacent  to  the  three  men  and  overheard  them  making  the  following  statements 
in  a  low  volume:  “I  don’t  know  if  that  much  can  bring  it  down”;  and  “they  mourned 
September  1 1th,  they  are  going  to  mourn  September  13th  as  well.”  Stone  further 
reported  that  the  three  men  mentioned  they  had  been  partying  in  Chicago  the 
previous  day  in  celebration  of  September  11,  2001,  and  they  were  five  hours 
behind  schedule  in  their  travel  to  Miami,  Florida.  As  the  men  left  the  restaurant, 
Stone  noted  that  they  paid  with  a  credit  card  and  two  of  the  men  got  into  a  cream 
colored  Nissan  Maxima  and  the  other  entered  a  black  newer  model  Honda,  both 
vehicles  displayed  Illinois  license  plates,  one  of  which  she  was  able  to  record, 
and  were  last  seen  entering  Interstate  75  southbound.  This  summary  was  the 
initial  information  that  was  reported  to  law  enforcement  authorities  by  Stone. 

GISAC  immediately  began  to  verify  the  information  that  had  been  provided 
to  authorities  and  at  11:45  a.m.  GISAC  called  the  Florida  Department  of  Law 
Enforcement  (FDLE)  to  advise  them  of  the  conversation  with  Stone.  Computer 
checks  of  the  tag  number  came  back  with  no  information,  the  tag  was  not  on  file 
in  the  national  database.  GISAC  contacted  Stone  to  verify  the  tag  number,  which 
she  did.  At  2:50  p.m.  authorities  in  Florida  were  advised  by  officials  with  the 
Illinois  Attorney  General’s  Office  that  their  local  information  revealed  that  the  tag 
number  should  be  displayed  on  a  1997  Buick  four-door  sedan  and  that  the  owner 
was  of  a  Latin  surname,  Munoz.  At  3:30  p.m.  Georgia  authorities  interviewed 
employees  of  the  Shoney’s  restaurant,  retrieved  the  credit  card  information  from 
the  transaction  of  the  three  men  and  re-interviewed  Eunice  Stone.  Law 
enforcement  authorities  were  unable  to  secure  video  tapes  from  Shoney’s  to 
corroborate  Stone’s  report.  At  5:30  p.m.  a  lookout,  to  law  enforcement,  for  the 
cars  and  the  men  was  issued,  by  authorities  in  Florida.  At  6:15  p.m.  that  same 
lookout  was  rebroadcast  in  Georgia  to  law  enforcement  officials  only. 

At  11:30  p.m.  a  Collier  County,  FL  deputy  sheriff  stopped  the  cream 

colored  vehicle  for  running  through  a  toll  booth  eight  miles  from  Interstate  75  on  a 

highway  known  as  Alligator  Alley.  The  black  vehicle  traveling  in  tandem  pulled 

over  behind  the  deputy  and  the  cream  colored  vehicle,  and  the  deputy  called  for 
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backup  assistance.  Within  minutes,  scores  of  law  enforcement  officers  arrived 
on  the  scene  and  the  scenario  that  played  to  a  national  audience  was  starting  to 
play  out.  The  manhunt  was  over,  but  the  investigation  and  public  critique  was 
just  beginning. 

Before  the  men  were  released,  an  in-depth  investigation  in  at  least  three 
states  went  forward  over  the  next  seventeen  hours.  Following  are  some  of  the 
results  of  the  investigation,  some  of  which  gave  suspicion  to  investigators  and 
lent  credibility  to  the  belief  that  the  men  may  have  had  evil  intent.  At  a  minimum 
some  results  gave  reason  to  believe  that  criminal  activity  may  have  been  afoot. 
Two  separate  bomb  dog  teams  alerted  on  the  trunks  of  both  vehicles.  While 
certainly  within  their  constitutional  rights,  the  men  refused  a  consensual  search  of 
their  vehicles.  One  of  the  men  made  the  statement,  “you  stopped  us  because  of 
what  we  said  at  that  restaurant  up  in  Georgia”.  The  first  interviews  with  the  men 
were  characterized  by  police  as  “uncooperative”  and  their  statements  did  not 
corroborate  each  other. 

In  the  end,  there  was  no  evidence  that  the  men  were  terrorists  or  that  they 
were  engaged  in  any  plot,  conspiracy  or  plan  to  harm  anyone.  The  conflicting 
vehicle  tag  information  was  investigated  and  explained,  the  motel  rooms  where 
they  stayed  were  clean,  the  credit  card  information  checked  out  with  no 
abnormalities  and  citizenship  and  visa  information  were  substantiated.  Even  the 
report  that  one  of  the  cars  failed  to  pay  the  toll  booth  was  inaccurate,  as  video 
footage  revealed  that  both  cars  did,  in  fact,  pay  the  tolls  and  the  $126  dollar  ticket 
had  to  be  voided. 

Step  back  in  time  to  the  dates  of  this  incident,  September  12-13,  2002. 
The  one-year  anniversary  of  the  most  devastating  terrorist  attack  against  civilians 
on  American  soil  had  the  country  feeling  uneasy  about  the  security  of  the 
homeland.  For  the  first  time  since  the  development  of  the  color-coded  Homeland 
Security  Threat  Advisory  System,  the  nation  had  been  placed  on  an  increased 
level  of  alert,  orange  (high)  from  a  yellow  (elevated)  only  a  few  days  earlier. 
National  leaders  and  the  press  did  not  name  any  specific  information  that  led  to 
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the  increase  in  the  threat  level  but  did  advise  law  enforcement  agencies  to 
maintain  a  “heightened  state  of  awareness”  although  no  specific  instructions 
were  given  on  how  to  meet  this  expectation.  The  people  were  told  to  go  about 
their  business  as  normal  but  to  “be  aware  of  [their]  surroundings”  and  to  “report 
any  unusual  activity  to  local  law  enforcement  authorities.”  Many  speculated  that 
terrorists  might  attempt  another  attack  on  or  near  the  anniversary  of  9/11.  The 
Federal  Emergency  Management  Agency  had  firmly  requested  that  the  state 
emergency  management  agencies  report  to  them  any  events  where  large 
gatherings  of  people  were  expected  to  assemble  the  week  prior  to  the 
anniversary.  Many  people  were  anxious.  It  was  in  this  environment,  that  Eunice 
Stone  called  the  police. 

D.  LESSONS  LEARNED  CONCERNING  REQUIREMENTS 

The  first  point  to  make  relative  to  this  case  study  is  that  the  information 
was  developed  locally.  Although  the  men  were  exonerated,  they  just  as  easily 
could  have  been  terrorists  planning  an  attack  or  individuals  on  the  FBI’s  terrorism 
watch  list.  The  information  did  not  come  from  spy  satellites,  telephone 
intercepts,  or  a  prison  cell  in  Guantanamo  Bay,  it  came  from  local  sources.  The 
Attorney  General,  the  FBI  Director  and  any  number  of  terrorism  experts  have  told 
us  repeatedly  that  the  enemy  is  here,  on  our  soil,  in  our  country  and  is  living 
among  us.  That  was  certainly  the  case  with  the  hijackers  of  9/1 1 ;  two  had  been 
living  in  my  hometown,  Atlanta,  Georgia!9  Today,  with  this  enemy  there  will  be 
domestic  and  foreign  sources  of  information  that  may  need  to  trigger  a  warning. 
Authorities  must  recognize  this  fact  and  reengineer  a  system  to  incorporate  the 
invaluable  contribution  of  local  inputs. 

Secondly,  there  must  be  a  one-stop-shop  to  gain  the  assistance  of  the 
federal  government  for  checking  the  status  of  people  on  various  federal  data 
bases  that  are  not  available  to  state  and  local  authorities.  Prior  to  the 
establishment  of  the  federal  Department  of  Homeland  Security  “nine  federal 
agencies  [that]  spanned  five  different  cabinet-level  departments  [maintained] 

9  Dave  Hirschman.  “Flight  School  Owner  Rues  Day  He  Saw  Terrorists”.  Cox  News  Service. 

1 1  September  2002. 


17 


twelve  terrorists  and  criminal  watch  lists.”10  Currently  in  Georgia,  the  GISAC 
checks  all  information  through  the  FBI  managed  Joint  Terrorism  Task  Force 
(JTTF)  located  one  floor  below  the  offices  of  GISAC.  The  JTTF  has  in  residence 
a  myriad  of  federal  agency  representatives  that  have  access  to  their  own 
databases  and  can  check  and  verify  information  submitted  by  GISAC  officials. 

Additionally,  there  is  a  need  for  states  to  have  a  clearinghouse  that  the 
federal  government  or  another  state  can  use  to  avoid  lengthy  delays  in  obtaining 
information.  Luckily,  in  this  incident  the  states  that  were  called  upon  had  offices 
that  “ran  interference”  in  their  own  state  and  were  able  to  obtain  vehicle  and 
driver  information  for  the  agents  at  GISAC.  What  would  have  happened  if  these 
states  did  not  have  a  central  point  of  contact?  What  would  have  happened  had 
the  case  been  more  complicated  and  rather  than  the  suspicion  of  an  explosive 
devise  there  was  the  suspicion  of  the  intentional  poisoning  of  the  food  supply,  a 
cyber  attack  on  the  power  grid,  or  a  biological  agent?  Would  there  have  been  a 
state  point  of  contact  that  could  have  provided  the  necessary  information  and 
contacts  required  to  disrupt  the  threat  in  time?  The  states  desperately  need 
Information  Sharing  and  Analysis  Centers  to  accommodate  these  types  of 
demands  for  information  exchange  on  a  full  time  basis. 

E.  REQUIREMENTS  TO  DEVELOP  STATE/LOCAL  INTELLIGENCE 

In  the  environment  after  9/1 1  states  also  must  be  able  to  provide  their  own 
capability  to  gather,  examine,  and  investigate  information.  In  the  days  and 
weeks  after  the  attacks  and  the  subsequent  legitimate  and  hoax  anthrax  events 
in  the  fall  of  2001  most  public  safety  organizations  were  bombarded  with  calls 
reporting  every  imaginable  suspicious  scenario.  While  most  of  these  well 
intentioned  reports  by  the  public  were  of  little  value,  there  were  some  reports  that 
warranted  further  investigation  and  yielded  information  that  was  beneficial  to 
public  safety  officials.  In  these  instances  where  people  called  local  and  state 
authorities  to  report  suspicious  behaviors  and  circumstances  they  believed  to  be 

10  Robert  F.  Dacey  and  Randolph  Hite.  Testimony  Before  the  Committee  on  Government 
Reforms,  House  of  Representatives.  Homeland  Security:  Information  Sharing  Responsibilities, 
Challenges  and  Key  Management  Issues.  United  States  General  Accounting  Office,  8  May  2003. 
p.34. 
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indicative  of  terrorists’  plots  or  the  location  of  members  of  terrorist  cells,  federal 
agencies  could  not  have  handled  the  volume.  Not  only  was  the  sheer  volume  a 
problem  but  the  criticality  and  reliability  of  the  information  was  not  of  the  level  that 
most  federal  law  enforcement  and  intelligence  organizations  require  prior  to 
taking  some  sort  of  action. 

Further,  states  should  develop  the  capacity  to  provide  their  own  policy 
makers  with  intelligence  to  enable  them  to  perform  the  necessary  homeland 
security  duties  at  that  level.  As  previously  mentioned,  billions  of  dollars  have 
been  awarded  to  states  to  enhance  homeland  security  efforts.  Each  state  has 
varying  threat  elements,  vulnerabilities  and  capabilities  to  respond  to  an  act  of 
terrorism.  In  the  current  environment,  states  must  have  the  capacity  to  scan  the 
environment  and  produce  intelligence  products  to  policy  makers  that  will  facilitate 
directing  resources  in  an  appropriate  manner.  Additionally,  there  are  special 
events  that  take  place  in  a  jurisdiction  that  may  or  may  not  attract  the  support  of 
federal  agency  intelligence  resources.  Even  if  federal  resources  are  engaged, 
state  officials  may  be  prohibited  from  accessing  those  intelligence  resources  due 
to  security  clearance  restrictions.  Also,  differences  in  missions  require  that  the 
state  be  able  to  provide  its  own  intelligence  for  policy  makers  for  a  particular  role 
or  event. 

In  the  upcoming  G8  Summit  to  be  held  in  Georgia,  the  state  and  federal 

roles  for  that  event  are  markedly  different.  As  will  be  discussed  in  more  detail 

later  in  the  next  chapter  the  intelligence  resources  of  the  federal  and  state 

governments  have  been  somewhat  combined  in  an  effort  to  fuse  information. 

Even  with  this  cooperative  effort  the  missions  assigned  to  each  level  of 

government  and  each  agency  involved  require  different  information  and  different 

intelligence.  For  example,  the  United  States  Secret  Service  is  the  lead  federal 

agency  and  is  primarily  concerned  about  dignitary  protection  in  a  few  very  finite 

areas  called  venues  many  of  which  are  extremely  isolated  by  the  ocean  and 

difficult  to  maneuver  terrain.  The  state  of  Georgia,  however  is  concerned  that 

since  the  venues  are  virtually  inaccessible  would  be  protestors  will  choose  to 

stage  protests  in  locations  far  removed  from  the  venues.  If  this  occurs,  it  is  the 

19 


problem  of  state  and  local  governments  to  manage.  Thus,  the  need  for 
intelligence  information  to  assist  in  determining  if  the  protestors  will  choose  a 
different  site,  whether  or  not  they  have  a  potential  for  violence  and  how  many 
there  will  be.  The  intelligence  requirements  for  distinct  missions  are  different. 

F.  CONCLUSION 

State  and  local  governments  do  have  a  role  in  the  new  homeland  security 
intelligence  efforts.  Hundreds  of  thousands  of  eyes  and  ears  in  local 
communities  can  provide  valuable  information  to  the  states  for  statewide 
intelligence  trends  and  to  the  federal  government  for  developing  regional  and 
national  tactical  intelligence.  The  states  have  a  need  for  strategic  intelligence  to 
make  wise  resource  allocation  decisions  and  tactical  intelligence  to  know  where 
the  enemy  is  residing  and  what  plans  and  capabilities  they  are  amassing.  States 
also  need  fulltime  ISACs  to  assist  other  states  in  investigating  fast  breaking 
incidents,  like  Alligator  Alley  and  to  issue  warnings  to  thwart  potential  attacks. 
This  capability  should  be  robust  should  the  incidents  be  more  complex  and 
involve  disciplines  other  than  law  enforcement. 

The  state  of  Georgia  has  developed  this  type  of  capability.  The  Georgia 
Information  Sharing  and  Analysis  Center  was  created  shortly  after  9/1 1  and  has 
fulfilled  one  of  the  missions  previously  lacking  in  our  state.  From  a  meeting  held 
the  Sunday  after  9/1 1  to  the  critical  role  GISAC  is  playing  in  preparations  for  the 
G8  Summit,  the  creation,  successes  and  future  challenges  of  GISAC  are 
described  in  the  next  chapter. 
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III.  THE  GEORGIA  INFORMATION  SHARING  AND  ANALYSIS 

CENTER 


After  9/11  Public  Safety  officials  in  Georgia  recognized  that  terrorists  had 
infiltrated  our  country  and  were  living,  planning  and  launching  attacks  against  us 
from  our  own  cities  and  neighborhoods.  These  officials  immediately  predicted 
the  tremendously  important  role  that  state  and  local  governments  would  have  to 
play  in  the  prevention  of  future  terrorist  attacks.  This  chapter  will  discuss  the 
establishment  of  a  statewide  information  sharing  and  analysis  function  in  Georgia 
and  examine  key  issues  addressed  that  ensured  the  success  of  this  newly 
created  capability.  Several  examples  will  be  used,  in  the  form  of  case  studies,  to 
validate  certain  fundamental  principles  that  were  established  early  on  in  the 
development  of  this  newly  created  unit.  Specifically  to  be  examined  is  the 
organizational  structure  of  the  unit  itself  and  more  broadly  the  reporting  structure 
of  the  unit  to  high  ranking  public  safety  officials  in  state  government.  These  initial 
decisions  and  founding  principles  will  prove  to  be  essential  to  the  success  of  this 
newly  established  organization.  Finally,  I  will  discuss  future  challenges  relating 
to  maintaining  the  integrity  of  founding  principles  and  embracing  expanded  roles 
like  the  involvement  with  the  intelligence  function  in  planning  for  the  Group  of 
Eight  Summit  (G8).  Maintaining  core  values  will  prove  to  be  critical  as  success  of 
this  new  capability  is  attracting  new  partners  to  the  arena. 

A.  CREATION  OF  GISAC 

On  October  25,  2001,  the  state  of  Georgia  launched  its  effort  into  the 
terrorism  intelligence  arena  by  establishing  the  Georgia  Information  Sharing  and 
Analysis  Center  (GISAC).  Obviously,  the  creation  of  this  state  level  “terrorism 
intelligence”  unit  was  in  direct  response  to  the  terrorist  attacks  that  occurred  in 
America  on  9/1 1 .  This  visionary  effort  was  initiated  prior  to  the  issuance  of  any 
national  guidance  or  strategies  suggesting  that  the  states  would  or  should  be 
included  in  an  intelligence  or  information  sharing  role  within  the  context  of 
Homeland  Security. 
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The  impetus  for  establishing  this  unit  was  the  direct  result  of  a  meeting 
conducted  on  Sunday,  September  16,  2001  between  a  small  group  of  state  level 
law  enforcement  and  emergency  management  officials  at  the  headquarters  of  the 
Georgia  Emergency  Management  Agency  in  Atlanta,  Georgia.11  The  purpose  of 
this  meeting  was  to  formulate  a  plan  for  the  state’s  involvement  in  the  fight 
against  terrorism  and  to  provide  to  the  Governor  that  plan  and  a  budget  for 
implementation.  It  is  interesting  to  reflect  upon  this  meeting  to  examine  the  initial 
recommendations  made  by  this  small  group  concerning  the  needs  for  the  state  of 
Georgia  and  compare  them  to  the  efforts  articulated  in  the  National  Strategy  for 
Homeland  Security.  To  be  sure,  the  National  Strategy  for  Homeland  Security  is  a 
much  more  comprehensive  document  than  is  the  plan  initiated  by  the  small  group 
that  Sunday  afternoon  but  some  of  the  initial  conclusions  were  strikingly  similar  in 
the  themes  that  were  developed.  Recommendations  were  made  to  enhance 
communications  and  collaboration  with  the  private  sector  regarding  critical 
infrastructure,  employing  more  planners  for  tactical  level  planning  to  ensure  the 
best  possible  state  response  should  an  act  of  terrorism  occur  in  Georgia, 
ensuring  that  communications  systems  were  sufficient  to  provide  timely 
warnings,  and  to  “get  back  into  the  intelligence  business,  so  we  will  know  what’s 
going  on  in  our  own  backyard”.12  Even  then,  arguably  that  group  was  addressing 
four  of  the  six  critical  mission  areas  that  would  be  published  in  July  of  2002  in  the 
National  Strategy  for  Homeland  Security,  domestic  counterterrorism,  protecting 
critical  infrastructure,  and  emergency  preparedness  and  response,  and 
intelligence  and  warning.13  Georgia  was  about  to  “get  back  into  the  intelligence 
business”  but  many  things  would  have  to  happen  before  the  GISAC  would 
become  the  critical  prevention  tool  for  the  State  of  Georgia  that  has  become. 

One  such  matter  occurred  on  October  25,  2001  when  Governor  Roy 
Barnes  named  the  state’s  first  Homeland  Security  Coordinator,  empanelled  the 
Georgia  Homeland  Security  Task  Force  and  created  the  GISAC  and  its  reporting 

11  The  meeting  referenced  was  attended  by  the  author. 

12  Remarks  cited,  with  permission,  during  that  Sunday  meeting  by  Vernon  Keenan,  Director 
of  the  Georgia  Bureau  of  Investigation. 

13  National  Strategy  for  Homeland  Security,  Washington,  D.C.:  July  2002.  p.  viii. 
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relationship  to  the  Task  Force.14  Here  I  will  discuss  the  importance  of  these 
executive  actions  and  subsequent  gubernatorial  actions  and  executive  orders 
that  contributed  to  the  success  of  GISAC.  The  unique  reporting  relationship  of 
GISAC  to  the  head  of  the  state  homeland  security  effort  and  to  the  members  of 
the  Task  Force  has  enabled  and  facilitated  information  sharing  envious  to  most 
communities  desirous  of  intelligence  capabilities. 

Below  we  will  take  a  journey  through  the  two  and  a  half  years  existence  of 
GISAC  from  the  initial  decisions  regarding  the  mission  of  GISAC  through  the 
current  involvement  the  unit  has  in  developing  intelligence  and  providing 
information  to  policymakers  in  preparation  for  the  Group  of  Eight  (G8)  Summit  to 
be  held  on  Sea  Island  June  8-10,  2004.  Additionally,  the  necessity  to  create  this 
unit  occurred  during  the  middle  of  a  state  budget  cycle.  How  would  it  be  staffed 
and  funded?  Where  would  the  GISAC  be  physically  located  and  what  other 
challenges  would  lie  ahead?  Once  established  the  GISAC  would  achieve  some 
successes  and  be  beneficial  to  other  efforts  including  the  G8  Summit  and  other 
high  profile  events  such  as  meetings  of  the  Free  Trade  Association  of  the 
Americas  (FTAA). 

B.  THE  MISSION  OF  GISAC 

It  is  important  to  recall  the  days  immediately  following  9/1 1  and  how  the 
mood  and  activities  of  public  safety  officials  were  dominated  by  this 
unprecedented  event.  Because  there  had  been  almost  no  capacity  at  the  state 
level  for  terrorism  intelligence  activities  and  very  little  support  for  even  minimal 
criminal  intelligence  efforts,  officials  were  seeking  a  way  to  not  only  develop 
information  on  terrorists  who  may  be  living  in  their  jurisdiction  but  also  to 
scrutinize  the  plethora  of  information  that  was  being  received  through  local, 
federal  and  media  channels.  One  specific  example  that  emphasized  the  need  to 
initiate  a  state-level  unit  that  would  be  central  to  all  available  terrorism 
intelligence  and  to  serve  as  the  clearinghouse  for  which  all  terrorism  information 


14  Maurice  Tamman  and  Duane  Stanford,  “Barnes  Planning  Anti-Terrorism  Intelligence 
Center  for  Georgia,”  Atlanta  Journal-Constitution .  26  October  2001 . 
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should  funnel  is  a  meeting  called  by  the  Special  Agent  in  Charge  (SAC)  of  the 
Atlanta  Office  of  the  Federal  Bureau  of  Investigation  (FBI).  This  office  serves  as 
the  headquarters  for  all  FBI  activities  in  the  state  of  Georgia. 

Many  public  safety  officials  in  Georgia,  especially  within  the  non-law 
enforcement  disciplines,  enjoy  a  collegial,  inclusive,  cooperative  relationship  with 
the  Atlanta  office  of  the  FBI.  Prior  to  and  since  9/1 1  it  was  commonplace  for  the 
FBI  to  include  state  and  local  officials  in  meetings  and  workgroups  where 
interagency  protocols  and  plans  are  developed  for  various  types  of  responses. 
Many  of  these  relationships,  both  organizational  and  individual,  date  back  to  the 
public  safety  preparations  for  the  Centennial  Olympic  Games  held  in  Georgia  in 
1996. 

Within  days  of  the  attacks  of  9/1 1  the  SAC  of  the  Atlanta  Office  of  the  FBI 
called  a  meeting  with  all  jurisdictions  of  local  and  state  law  enforcement  agencies 
that  comprise  the  Metropolitan  Atlanta  Area.  The  purpose  of  that  meeting  was  to 
relay  information  to  that  group  on  the  existence  of  “raw”  intelligence  information 
that  specified  Atlanta  as  a  target  of  Al  Qaeda  terrorists.  The  information  was  that 
tall  buildings  and  sports  facilities  might  be  the  objects  of  an  attack.  It  was 
stressed  that  this  information  was  raw  and  unverified  and  that  efforts  were 
underway  to  verify  the  credibility  of  the  information.  It  was  further  communicated 
that  regardless  of  the  security  clearance  status,  or  lack  thereof,  of  the  local  and 
state  law  enforcement  community;  the  FBI  would  pass  along  information  that 
posed  a  threat  to  the  population  of  the  City  of  Atlanta  and  of  the  State  of  Georgia. 
Two  days  after  that  meeting  all  of  the  attendees  were  personally  contacted  and 
informed  that  after  thorough  investigation  the  information  had  not  only  been 
determined  to  be  “not  credible”  but  in  fact  had  been  fabricated.15 

Despite  the  excellent  relationship  that  is  enjoyed  with  the  FBI  in  Georgia, 
common  sense  dictated  that  a  meeting  would  not  be  called  every  time  there  was 
intelligence  to  be  shared  and  that  at  some  point  there  would  be  information  that 
the  state  did  not  receive  that  we  thought  to  be  important.  Further,  the  State  felt 

15  The  author  was  present  at  the  meeting  September  14,  2001 ,  see  also:  Maurice  Tamman, 
“Terrorist  Plot  to  Hit  Atlanta  Proves  a  Hoax,”  Atlanta  Journal-Constitution,  1 3  December  2001 . 
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like  there  may  be  instances  where  we  had  the  duty  to  share  information  with 
jurisdictions  that  were  not  at  the  table  and  would  not  be  able  to  get  the 
information  in  a  timely  manner.  Additionally,  we  highly  suspected  (and  it  was 
later  confirmed)  that  members  of  Al  Qaeda  were  living  and  planning  in  our  own 
backyard.  Therefore,  we  needed  to  utilize  every  resource  available  through  state 
and  local  governments  to  develop,  analyze,  and  investigate  all  information  on 
potential  terrorists  to  deny  and  interdict  their  activities.  Finally,  we  understood 
the  limited  resources  and  constraints  upon  the  federal  government  and  the 
intelligence  community  and  knew  that  in  the  future  state  and  local  governments 
would  play  a  vital  role  in  the  collection  and  development  of  terrorism  intelligence. 
Since  terrorists  have  infiltrated  our  country  and  are  living  among  us,  those  best 
positioned  to  gather  information  are  the  people  working  in  every  local  community. 

With  these  assumptions  and  facts  being  considered  the  mission  of  the 
GISAC  was  formed  and  is  articulated  in  internal  documents  as  follows: 

The  mission  assigned  to  the  GISAC  project  was  to  serve  as  the 
focal  point  for  the  collection,  assessment,  analysis,  and 
dissemination  of  terrorism  intelligence  information  relating  to 
Georgia.  GISAC  was  not  intended  to  replace  or  duplicate  the 
counter-terrorism  duties  of  the  Federal  Bureau  of  Investigation,  but 
rather  to  enhance  and  facilitate  the  collection  of  intelligence 
information  from  local  and  state  sources,  and  to  integrate  that 
intelligence  information  into  a  system  that  will  benefit  homeland 
security  and  counter-terrorism  programs  at  all  levels. 

Soon  after  it  began  operations,  GISAC  established  itself  as  the 
state’s  clearinghouse  for  terrorism-related  intelligence  information. 

It  quickly  developed  protocols  and  relationships  that  enhanced  its 
capabilities  for  the  gathering,  assessment,  analysis,  exchange,  and 
dissemination  of  intelligence  information  between  local,  state,  and 
federal  government  agencies;  corporate  security  executives;  and 
the  private  sector  owners  and  operators  of  critical  infrastructure 
assets.16 


16  Georgia  Homeland  Security  Task  Force.  The  Georgia  Information  Sharing  and  Analysis 
Project.  Atlanta,  Georgia,  p.  2. 


25 


C.  STAFFING  AND  HOW  THE  MISSION  IS  ACCOMPLISHED 

1.  Staffing 

Although  the  Georgia  Bureau  of  Investigation  (GBI)  manages  the  GISAC 
five  other  organizations  contribute  personnel  that  fill  the  seventeen  positions  at 
GISAC.  And  while  these  are  the  only  full  time  employees  of  GISAC  numerous 
state  agencies  and  private  businesses  provide  twenty-four  hour  points  of  contact 
for  individuals  expert  in  their  field  who  can  provide  technical  expertise  toward  the 
efforts  of  GISAC.  For  example,  the  Division  of  Public  Health  provides  contacts 
that  facilitate  information  exchange  between  epidemiologists  and  GISAC 
regarding  bio  terrorism  information  and  disease  surveillance  information  that  may 
have  intelligence  value.  The  Georgia  Department  of  Agriculture  provides  on  call 
personnel  to  liaise  with  GISAC  concerning  agroterrorism  issues.  The  Georgia 
Technology  Authority  assigns  network  security  officers  to  dialog  with  GISAC 
personnel  to  inform  of  concerns  relating  to  potential  cyber  security  threats  and 
attacks.  This  capacity  is  similar  to  and  is  modeled  after  emergency  management 
organizations  that  manage  recovery  efforts  through  emergency  operations 
centers.  Those  centers  are  staffed  with  personnel  from  various  agencies  who 
are  able  to  commit  resources  on  behalf  of  their  agency  toward  recovery  efforts 
subsequent  to  a  natural  disaster.  During  non-disaster  periods,  the  same 
personnel  provide  planning  and  training  assistance  to  the  emergency 
management  agency  in  preparation  for  eventual  disasters.  Similarly,  GISAC 
counts  on  “adjunct”  personnel  or  trusted  partners.  They  are  not  physically 
present  in  the  office  but  are  available  to  provide  technical  assistance,  information 
and  coordination  within  their  area  of  expertise,  when  needed. 

The  full  time  employees  of  GISAC,  their  respective  assignments  and 

parent  agencies  are  listed  below: 

Georgia  Bureau  of  Investigation 
Inspectors  -  1 

Special  Agents  in  Charge  -  1 
Assistant  Special  Agents  in  Charge  -  1 
Intelligence  Analysts  -  2 
Special  Agents  -  6 
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Georgia  State  Patrol 
Investigators  /  Analysts  -  1 

Georgia  Emergency  Management  Agency 
Critical  Infrastructure  Analysts  -  2 

Georgia  National  Guard 
Intelligence  Analysts  -  1 

Georgia  Sheriff’s  Association 
Investigators/Agents  -  1 

Georgia  Association  of  Chiefs  of  Police 
Investigators/Agents  -  1 

2.  Reporting  and  Chain  of  Command 

As  mentioned  earlier,  the  GISAC  was  created  on  October  24,  2001 
simultaneously  with  the  Georgia  Homeland  Security  Task  Force  and  the 
appointment  of  the  state’s  Homeland  Security  Coordinator.  There  is  one 
additional  action,  an  executive  order  issued  on  March  13,  2003  that  directly 
impacts  the  reporting  status  of  the  GISAC.  The  subject  of  both  executive  actions 
(one  an  announcement  and  one  a  formal  executive  order)  was  to  establish  the 
framework  for  how  the  homeland  security  efforts  were  to  function  in  the  State  of 
Georgia.  Conseguently,  however,  each  order  effected  GISAC;  the  first  of  course, 
more  than  the  second.  It  is,  however,  important  to  understand  the  political 
environment  and  circumstances  of  both  executive  orders  and  their  implications 
upon  the  chain  of  command. 

Each  executive  decision  was  issued  by  a  different  Governor  as  the 
gubernatorial  elections  held  in  November  2002  changed  the  majority  political 
party  in  Georgia  for  the  first  time  in  135  years.  Naturally,  this  change  in  political 
power  prompted  changes  in  leadership  within  some  agencies  of  state 
government.  Public  safety  agencies  represented  on  the  Homeland  Security  Task 
Force  were  not  exempted  from  these  changes  and  indeed  the  person  who  had 
previously  been  the  coordinator  of  the  Homeland  Security  Task  Force  resigned. 
Although  change  was  implemented  regarding  the  Homeland  Security  function, 
the  GISAC  model  and  many  of  the  players  remained  the  same  and  the  mission 
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has  been  left  intact.  The  first  or  enabling  executive  action  was  issued  under  an 
administration  that  chose  to  have  a  position  entitled  Commissioner  of  the 
Department  of  Public  Safety.  The  Commissioner  was  among  the  highest  levels 
in  state  government  and  commanded  a  large  majority  of  the  state’s  law 
enforcement  resources;  many  referred  to  the  position  as  the  Supercop.  Among 
the  agencies  that  reported  to  the  Supercop  were:  the  Georgia  State  Patrol,  the 
Georgia  Bureau  of  Investigation,  the  Criminal  Justice  Coordinating  Council,  the 
Capitol  Police  Services,  and  various  smaller  entities.  Germane  to  this  subject, 
however,  is  that  the  Supercop  was  also  named  as  Coordinator  of  the  Georgia 
Homeland  Security  Task  Force  in  that  first  announcement  that  enabled  the 
creation  of  GISAC  and  the  Homeland  Security  Task  Force. 

The  chain  of  command  that  was  established  for  the  GISAC  at  its  inception 
was  that  the  unit  and  its  commander  reported  to  the  Coordinator  of  the  Georgia 
Homeland  Security  Task  Force,  who  at  the  time  was  the  Commissioner  of  the 
Department  of  Public  Safety,  or  Supercop.  Even  though  the  commander,  at  the 
time,  was  the  rank  of  Special  Agent  in  Charge  (SAC)  employed  by  the  GBI  the 
unit  was  created  as  an  equally  subordinate  entity  to  the  Coordinator  of  Homeland 
Security  and  the  GBI,  therefore  the  SAC  reported  directly  to  the  Supercop.  Had 
the  unit  not  been  established  as  its  own  entity  this  reporting  arrangement  could 
not  have  been  implemented  as  it  skipped  at  least  four  levels  of  management 
within  the  GBI  and  would  have  violated  even  the  most  liberal  interpretations  of 
chain  of  command. 
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Original  Reporting  Structure  of  GISAC 
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Deputy  Director  of 
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Figure  1.  Original  GISAC  Organization  Chart 


The  second  gubernatorial  action  was  in  the  form  of  an  executive  order 
signed  March  13,  2003  and  was  issued  by  a  different  governor.  This  order 
changed  the  structure  of  Homeland  Security  in  Georgia.  Even  prior  to  that  order, 
however,  the  Governor  had  accepted  the  resignation  of  the  Homeland  Security 
Coordinator/Supercop  and  decided  to  abolish  the  position  of  Supercop.  Instead, 
he  changed  the  reporting  hierarchy  of  all  state  agencies  toward  a  cabinet  type  of 
structure  comprised  of  six  cabinet  positions.  One  of  those  cabinet  positions  is 
the  Director  of  the  Georgia  Office  of  Homeland  Security.  Currently,  except  for 
matters  pertaining  to  Homeland  Security,  neither  the  GBI  nor  any  other  law 
enforcement  agency  report  directly  to  the  Director  of  Homeland  Security.  The 
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GISAC,  however,  does  report  directly  to  the  Director  of  Homeland  Security  and 
this  reporting  arrangement  was  dictated  by  the  second  executive  order.  The 
Inspector  in  charge  of  GISAC  still  reports  directly  to  the  state  head  of  Homeland 
Security,  but  it  is  a  different  political  situation  all  together.  Now,  rather  than 
reporting  to  his  boss’s  boss  three  levels  removed  (a  very  awkward  situation),  he 
reports  to  the  head  of  an  entirely  different  cabinet  organization.  As  it  stands 
today,  the  entity  of  GISAC  is  an  asset  of  the  Georgia  Office  of  Homeland  Security 
but  it  is  staffed  by  individuals  employed  by  other  agencies  as  listed  above.  Even 
through  political  transition  a  founding  principle  of  GISAC  has  remained  intact;  the 
unit  must  have  unobstructed  access  to  the  head  of  the  state’s  Homeland  Security 
structure. 


Reporting  Structure  of  GISAC  After  Creation 
of  the  Georgia  Office  of  Homeland  Security 


Figure  2.  Current  GISAC  Organization  Chart 


D.  HOW  DOES  GISAC  WORK  AND  WHAT  DO  THEY  DO? 

Consistent  with  its  mission  statement  the  primary  role  of  GISAC  is  “to 
serve  as  the  focal  point  for  the  collection,  assessment,  analysis,  and 
dissemination  of  terrorism  intelligence  information  relating  to  Georgia.”17  The 
mission  of  GISAC  was  directly  influenced  by  the  many  concerns  enumerated 

17  Ibid. 
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earlier  in  this  text.  One  concern  was  that  many  different  state  and  local  agencies 
had  to  juggle  multiple  sources  of  information.  These  sources  of  information 
included  organizations  in  both  the  public  and  private  sector.  Additionally,  there 
existed  a  fear  that  meetings  previously  held  for  the  purpose  of  disseminating 
information  would  be  curtailed  and  the  state  would  miss  out  on  critical 
information.  Further,  leaders  in  the  state  believed  that  they  had  the  responsibility 
to  make  independent  determinations  and  evaluations  regarding  terrorist 
information.  Therefore,  the  state  of  Georgia  decided  to  put  our  flag  out 
proclaiming,  “here  is  where  you  deliver  information  concerning  terrorism 
intelligence”  and  likewise  “if  we  have  anything  to  tell  you  about  terrorists’ 
activities,  it  will  be  told  from  here.”  In  other  words,  this  GISAC  is  going  to  be  our 
one  stop  shop  for  terrorism  intelligence.  In  addition  to  being  the  focal  point  for 
intelligence  in  the  State  of  Georgia,  GISAC  also  facilitates  collection  of 
intelligence  from  local  law  enforcement  and  non-law  enforcement  sources, 
investigates  information  obtained,  analyzes  information,  makes  determinations 
on  information  dissemination,  and  produces  certain  products  for  customers. 

Upon  establishing  GISAC  it  was  important  for  the  management  to 
publicize  its  existence  in  order  to  facilitate  the  collection  of  information  from  the 
vast  local  sources  available  in  Georgia.  Those  vast  sources  and  the  sheer 
number  of  local  jurisdictions  in  the  state  complicated  the  effort  in  spreading  the 
word  of  GISACs  creation  and  mission.  There  are  159  counties,  over  650 
municipalities  and  40,000  certified  peace  officers  in  Georgia.  The  sheer  volume 
of  potential  inputs  into  GISAC  is  staggering  but  is  also  testimony  as  to  why  state 
and  local  governments  must  be  involved  in  the  collection  of  terrorism  intelligence 
information.  Over  forty  thousand  eyes  and  ears  in  the  field;  and  that  is  just  the 
certified  peace  officers  not  including  all  of  the  other  government  workers  serving 
in  those  communities  who  can  also  be  trained  to  gather  information! 

Through  many  associational  meetings,  personal  visits,  teletype 

broadcasts,  training  conferences  and  word  of  mouth  the  creation  of  GISAC 

reached  a  majority  of  the  organizations  that  needed  to  know  of  its  existence. 

While  most  of  the  call  volume  is  handled  by  the  existing  staff,  overnight  reporting 
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and  overflow  calls  are  processed  by  the  call  center  staffed  by  the  Georgia 
Emergency  Management  Agency  which  is  transparent  to  the  caller.  On  call 
GISAC  staff  members  are  immediately  notified  of  inputs  or  messages  that  require 
urgent  attention. 

Obviously,  one  of  the  primary  roles  performed  by  GISAC  is  to  investigate, 
analyze  and  make  a  determination  regarding  the  wide  variety  of  information  that 
is  reported.  The  managers  at  GISAC  are  fortunate  in  that  they  have  been  given 
the  authority  to  task  any  active  GBI  agent,  in  the  furtherance  of  an 
investigation.18  This  is  a  critically  important  capability  allowed  by  the  Director  of 
the  GBI  because  of  the  large  geographic  area  of  the  state.  There  are  areas  of 
the  state  that  are  as  much  as  six  hour  drives  from  Atlanta,  the  headquarters  of 
GISAC.  The  ability  to  task  GBI  agents,  assigned  to  field  offices  in  all  areas  of  the 
state,  ensures  timely  responses  to  incidents  that  require  immediate  investigative 
attention.  Most  information  that  is  reported  can  be  examined,  investigated  and 
cleared  from  the  agent’s  desk  in  a  minimal  amount  of  time,  while  other  cases  are 
extremely  complex  requiring  extensive  investigation,  analysis  and  ultimately  the 
issuance  of  an  alert. 

An  example  of  a  simple  yet  interesting  case  occurred  shortly  after  the  unit 
was  established.  I  actually  received  a  call  from  an  official  with  the  Georgia 
Department  of  Agriculture  who  stated  his  concerns  to  me  regarding  an  applicant 
for  a  vacant  food  inspector  position.  The  applicant  had  persistently  called 
inquiring  about  the  status  of  his  application  for  the  position  and  was  extremely 
interested  in  securing  that  particular  job.  The  concern  of  the  manager  was  that 
the  qualifications  of  the  individual  applying  were  well  above  the  required 
education  level,  as  he  had  a  Doctor’s  degree  in  Chemistry  from  a  University 
located  in  a  certain  Middle  Eastern  Country.  The  manager  explained  to  me  that 
the  job  had  been  awarded  to  another  more  suitable  candidate,  but  the 
persistence  of  this  particular  individual  toward  a  job  for  which  he  was  incredibly 
overqualified,  had  raised  suspicions  of  the  candidate’s  true  intent.  Because  this 

18  Interview  with  Inspector  Bob  Hardin,  Commander  of  GISAC,  26  January  2004. 
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occurred  so  early  on  in  the  establishment  of  GISAC  and  all  of  the  agency  contact 
information  had  not  been  developed,  the  manager  asked  that  I  forward  the 
information  to  the  appropriate  person.  This  was  good  information  to  pass  along 
as  the  applicant  had  provided  a  substantial  amount  of  personal  and  contact 
information  through  his  resume.  As  far  as  I  or  anyone  associated  with  GISAC 
knows,  the  individual  was  determined  to  be  clean  and  was  not  linked  to  any  type 
of  terrorist  activity  but  had  there  been  a  law  enforcement  or  federal  government 
interest  in  this  person  they  now  had  the  information  to  locate  him.  The  role  of  the 
GISAC  in  this  case  was  merely  to  document  the  information,  forward  the  resume 
to  the  FBI  and  ask  them  to  run  a  check  on  the  person.  In  this  instance  the 
system  worked  and  was  an  example  of  a  simple  flow  of  information  to  the 
appropriate  point  and  a  computer  check  of  the  individual.  Other  cases,  however, 
become  much  more  complicated  and  demonstrate  the  value  of  having  agencies 
that  do  not  normally  work  together  being  involved  in  a  collaborative  effort  to 
develop  intelligence. 

The  involvement  of  GISAC  in  case  of  a  Nigerian  man  attempting  to 
fraudulently  purchase  vital  records  is  an  example  of  how  federal,  state  and  local 
authorities  worked  together  to  identify,  collect  and  develop  intelligence 
information.  Additionally,  this  case  was  prompted  by  a  “non-traditional”  member 
of  the  GISAC  system;  an  employee  from  the  state’s  Vital  Record  Section  of  the 
Division  of  Public  Health.  Through  the  adjunct  staff  (or  trusted  partner),  GISAC 
was  notified  of  an  individual  that  was  attempting  to  order  a  birth  certificate  on  a 
child  who  was  deceased.  GISAC  personnel  queried  the  databases  they  had 
access  to  and  requested  that  their  federal  contacts  do  the  same  to  see  if  the 
individual  who  had  requested  the  birth  certificate  was  a  fugitive  or  was  on  any 
particular  watch  list.  After  the  various  checks  yielded  no  meaningful  information 
and  was  negative  for  the  person  being  on  any  “wanted  list”,  GISAC  personnel 
invited  federal  and  local  partners  to  participate  in  a  controlled  delivery  of  the 
requested  birth  certificate.  Therefore,  instead  of  denying  the  man  access  to  the 
illegally  requested  item,  the  item  was  delivered  to  him  while  law  enforcement 
officials  monitored  each  step  of  the  process.  Upon  the  delivery  and  receipt  of  the 
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birth  certificate  the  man  was  arrested  and  his  residence  searched.  Below  is  an 
excerpt  from  the  summary  of  the  incident  found  in  the  intelligence  bulletin 
prepared  by  GISAC. 

[The  man ]  initially  claimed  to  be  William  Luther  Smith  and  produced 
a  Georgia  driver’s  license,  a  social  security  card  and  an  active 
United  States  Army  Identification  supporting  his  claim.  Later, 
during  an  interview,  [the  man]  admitted  that  William  Luther  Smith 
was  not  his  true  identity,  but  that  he  was  presently  active  in  the 
United  States  Army  in  an  Intelligence  Unit  stationed  in  Korea  under 
the  false  identity.  [The  man]  stated  that  he  had  been  in  the 
Nigerian  Military.  Officers  found  photographs  in  the  apartment  of 
[the  man]  in  his  Nigerian  Armed  Services  uniform  as  well  as  in  a 
United  States  Army  uniform.  [The  man]  was  taken  into  custody  on 
forgery  charges....  Officials  from  the  United  States  Army  were 
notified  and  are  also  investigating  the  incident.19 

Again,  this  example  shows  the  need  to  have  a  system  that  accommodates 
information  that  is  obtained  locally  and  by  “non  traditional”  partners.  The  man  did 
not  live  in  Spain  or  North  Africa;  he  lived  in  Georgia.  Further,  it  demonstrates  the 
need  to  include  all  levels  of  government  in  the  intelligence  process.  In  this  case 
the  Vital  Records  Section  could  have  just  denied  the  request;  end  of  story. 
Instead,  the  employee  passed  the  information  along  to  someone  who  could  get 
access  to  a  system  that  could  investigate  it  further.  Then,  once  the  information 
was  gathered  and  the  suspect  was  arrested  the  State  could  have  just  processed 
the  case  like  any  other  case  but  they  did  not.  They  called  in  the  appropriate 
federal  and  military  authorities  to  investigate  further.  Would  that  have  been  done 
five  years  ago?  Probably  not.  Would  any  of  this  have  been  done  five  years  ago? 
No,  but  9/1 1  changed  the  world  and  it  is  changing  the  way  people  and 
organizations  work  together  and  the  participants  in  the  intelligence  community. 

Whether  the  investigation  is  simple  or  complex  GISAC  is  the  agency  that 
processes  terrorism  related  information  in  the  State  of  Georgia.  Therefore, 
GISAC  must  determine  the  appropriate  disposition  of  the  information  that  is 
processed  through  the  Center.  Possible  dispositions  include  further  investigation 

19  Georgia  Office  of  Homeland  Security.  Intelligence  Bulletin,  Issue  21 ,  September  2003. 
Atlanta,  Georgia,  p.  1.  The  original  document  lists  all  of  the  agencies  with  personnel  assigned  to 
GISAC  on  a  full  time  basis. 
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and  inquiry  of  the  information,  attempting  to  develop  the  information  or  lead 
further,  taking  no  action  or  filing  the  information  or  passing  it  to  the  federal 
authorities.  The  unique  concept  of  GISAC  is  that  all  parties  involved  in  the 
Center  have  an  opportunity  to  influence  the  disposition  of  the  intelligence  and  the 
information  brought  into  the  Center.  Quoting  from  an  internal  GISAC  document: 

After  review  by  GBI  supervisors,  the  ‘raw’  terrorism  intelligence 
information  is  forwarded  to  GISAC’s  [numerous,  multidiscipline] 
representatives,  who  review  it  within  the  context  of  their  own 
particular  areas  of  interest  and  responsibility.  The  [various] 
representatives  may  subsequently  recommend  certain  actions  to 
GISAC  supervisors  and/or  their  own  agency/organization  managers 
in  order  to  disrupt  or  prevent  possible  terrorist  attacks,  or  to  mitigate 
and  manage  the  consequences  of  an  attack.20 

It  is  officially  a  written  part  of  the  concept  of  operations  to  ensure  that  no 
information  is  withheld  from  various  disciplines  in  the  center  due  to  agency  origin 
or  level  of  employment.  My  opinion  is  that  the  GEMA  representatives  have  a 
particularly  diligent  responsibility  in  considering  the  impact  of  the  information. 
The  reason  for  this  belief  is  that  many  disciplines  and  departments  are  not 
represented  in  the  Center  on  a  full  time  basis  therefore  GEMA  must  make  a 
determination  on  their  behalf.  The  other  full  time  employees  of  GISAC  are 
members  of  law  enforcement  agencies  or  the  National  Guard,  therefore  GEMA  is 
expected  to  represent  the  interests  of  all  other  associated  disciplines  with  regard 
to  the  information. 

As  with  all  intelligence  units  the  analytical  function  plays  a  vitally  important 
role.  The  GISAC  employs  analysts  who  provide  various  types  of  analytical 
support  to  the  agents  and  customers  of  the  Center.  Examples  and  descriptions 
of  that  type  of  support  are  as  follows: 

•  Fusing  Information:  Review  and  merge  intelligence  information 
with  existing  data  in  the  intelligence  system  so  that  it  may  be 
analyzed. 

•  Link  Charting:  Establish  relationships  among  entities,  individuals 
or  organizations  in  an  investigation. 


20  Georgia  Homeland  Security  Task  Force.  Information  Sharing  and  Analysis  Project,  p.  9. 
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•  Event  Charting:  Show  the  chronological  relationships  between 
persons,  organizations,  and  related  events. 

•  Flow  Charting:  Depict  the  flow  of  money,  narcotics,  weapons, 
stolen  goods  or  other  commodities  through  the  elements  of  a 
criminal  and/or  terrorist  network. 

•  Activity  Charting:  Define  the  pattern  or  sequence  of  a  terrorist 
operation,  including  modus  operandi. 

•  Telephone  Toll  Analysis:  Condense  large  volumes  of  data  into 
easy  to  read  automated  reports  from  which  the  significant 
telephone  activity  may  be  identified. 

•  Case  Analysis:  Summarize  intelligence  information,  investigative 
actions  taken  and  the  main  findings  associated  with  these  actions, 
and  the  activities  of  the  subjects. 

•  Special  Publications:  Develop  publications  on  various  terrorism 
intelligence  topics.  The  topics  are  determined  by  interest, 
availability  of  data  and  need  for  the  information.21 

Other  products  are  regularly  produced  and  disseminated  by  GISAC.  The 
first  type  of  report  that  was  developed  and  is  still  in  use  today  is  the  monthly  Law 
Enforcement  Sensitive  Report  that  is  distributed  to  all  law  enforcement  agencies 
in  the  state.  These  reports  contain  information,  which  is  not  classified  but  should 
not  be  distributed  to  the  general  public.  Additionally,  a  weekly  Open  Source 
Report  is  provided  to  the  member  agencies  of  GISAC,  fire  departments  and  other 
agencies  that  have  an  interest  in  Homeland  Security.  This  report  is  very 
informative  as  there  are  plentiful  amounts  of  information  obtained  through  public 
sources  that  is  valuable  to  policy  makers.  The  management  of  GISAC  gives  an 
intelligence  briefing  to  the  Georgia  Homeland  Security  Task  Force  at  every  bi¬ 
weekly  meeting  as  well  as  to  the  G8  planning  group  that  meets  weekly.  And  of 
course,  when  the  need  arises  various  alert  bulletins  are  disseminated  to 
organizations  and  to  owners  of  critical  infrastructure.  Last,  ongoing  threat 
assessments  concerning  many  groups  and  special  events  are  provided  to  key 
leaders  who  have  a  need  to  know  for  purposes  of  planning  security  in  and 
around  these  special  events. 


21  Ibid.,  pp.  12-13. 


36 


E.  FACILITIES  -  WHERE  IS  GISAC? 

When  GISAC  was  established  there  was  an  immediate  need  to  find  office 
space  for  the  staff.  When  money  is  not  a  problem  usually  space  and  many  other 
things  are  not  a  problem  either.  Money  was  a  problem  in  the  early  days  of 
GISAC  as  the  entity  was  created  in  the  middle  of  the  state  fiscal  year  so  paying 
rent  was  not  an  option.  Luckily,  GEMA  was  able  to  make  available  about  2500 
square  feet  of  space  adjacent  to  the  State  Operations  Center.  This  office  space 
was  no  stranger  to  some  of  the  special  agents  assigned  the  initial  GISAC  duty  as 
it  was  the  same  space  utilized  by  the  GBI  to  command  the  Intelligence  Detail 
Teams  for  the  Centennial  Olympic  Games.  The  space  is  secure,  below  grade, 
and  has  more  than  adequate  backup  power  capacity;  further,  it  is  adjacent  to  the 
main  floor  of  the  State  Operations  Center  and  the  Communications  Center  for 
GEMA,  which  also  serves  as  the  state’s  24-hour  warning  point.  Because  the  GBI 
Intelligence  Detail  Teams  use  the  room  as  a  command  center  during  every 
special  event  of  any  importance  the  room  had  been  nicknamed  the  GBI  room.  It 
was  only  fitting  then  to  establish  those  rooms  as  the  first  headquarters  of  GISAC, 
and  the  price  was  right  too! 

After  several  months  of  operation  it  became  apparent  that  more  spacious 
and  convenient  accommodations  were  warranted.  Although  many  improvements 
to  the  space  were  made  including  robust  security  measures  to  ensure  the 
integrity  of  the  information  and  files  being  kept,  GISAC  was  simply  outgrowing 
the  makeshift  offices  in  the  underground  command  center  of  GEMA.  Further,  the 
FBI  through  the  Joint  Terrorism  Task  Force  (JTTF)  had  emerged  as  a  key  player 
with  GISAC  as  the  state  intelligence  agency  needed  a  federal  partner  to  check 
information  and  run  people  on  various  federal  databases.  In  the  current  office 
arrangement  at  GEMA  the  trip  between  the  two  offices  took  about  30  minutes,  so 
the  face  to  face  interaction  that  needed  to  take  place  in  some  instances  was 
thwarted  by  time  and  distance.  Negotiations  were  initiated  between  the  upper 
management  of  the  FBI  and  State  Officials  concerning  some  available  office 
space  in  the  office  building  where  the  FBI  rented  their  offices.  A  private  company 
had  declared  bankruptcy  and  moved  out  far  short  of  their  lease  period  and  the 

37 


FBI  had  first  right  of  refusal  on  the  property  as  it  was  only  one  floor  above  the 
offices  of  the  JTTF.  Through  much  negotiation  and  bureaucratic  challenges  on 
both  the  state  and  federal  sides  of  the  table  a  deal  was  made  and  the  GISAC 
relocated  to  the  same  building  as  the  Atlanta  Office  of  the  FBI  and  the  JTTF. 
The  move  took  about  a  month  to  complete  but  in  September  2002  GISAC  had  a 
new  home  and  at  around  7,700  square  feet,  it  was  three  times  the  size  of  their 
old  home.  The  move  has  proven  to  be  a  wise  decision  as  managers  in  both 
organizations  have  stated  that  the  close  proximity  of  the  two  units  has  fostered  a 
closer  and  more  trusted  working  relationship  between  the  two. 

F.  FUNDING 

Since  the  establishment  of  GISAC  occurred  and  operations  commenced 
late  in  the  second  quarter  of  the  state’s  fiscal  year,  funding  and  staffing  for  the 
project  was  a  significant  concern.  Between  October  25,  2001  and  April  1,  2002, 
the  resources  utilized  for  the  unit  were  taken  from  the  existing  budgets  of 
participating  agencies.  After  April  1 ,  2002,  a  supplemental  appropriation  was 
made  available  by  recommendation  of  the  Governor  and  approval  of  the  Georgia 
General  Assembly.  The  supplemental  appropriation,  however,  only  covered  the 
cost  of  nine  budgeted  positions,  the  standard  regular  operating  expenses 
associated  with  those  positions  and  a  one-time  allocation  of  $500,000  for  office 
build  out  and  equipment  costs.  Thus,  the  total  continuing  state  budget  for  GISAC 
is  the  personnel  services  allocation  for  seven  GBI  special  agent  positions,  two 
analyst  positions,  two  GEMA  critical  infrastructure  planner  positions  and  $67,  000 
for  regular  operating  expenses.22  Therefore,  other  funding  and  staffing 
resources  had  to  be  identified  in  order  to  operate  the  unit  so  that  its  mission 
could  be  fulfilled.  In  the  2002-2003  fiscal  year  the  unit  was  awarded  a  Bryne 
grant  by  the  Criminal  Justice  Coordinating  Council  in  the  amount  of  $400,  000. 
Had  it  not  been  for  this  grant  the  move  to  the  FBI  building  would  have  not  been 
possible  as  the  majority  of  this  grant  is  spent  on  real  estate  rental.  Since  that 
award  there  has  been  no  additional  funding  for  the  GISAC. 


22  Office  of  Planning  and  Budget.  Governor’s  Amended  Budget  FY02.  Atlanta,  Georgia. 
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G.  WHAT  DOES  THE  FUTURE  LOOK  LIKE? 

I  have  examined  the  meetings,  press  releases  and  executive  orders 
involved  in  the  creation  of  GISAC.  We  have  looked  at  changes  in  leadership 
within  the  state  homeland  security  structure  and  the  physical  moves  of  the 
GISAC  offices.  A  few  examples  of  actual  cases  have  been  studied,  from  the 
simple  to  the  more  complex,  proving  that  GISAC  works,  is  needed  and  is  a  player 
in  the  intelligence  community  as  it  relates  to  the  state  of  Georgia.  Now  what? 
What  lies  ahead  for  GISAC  and  how  will  it  continue  to  transform  from  its  roots  of 
“knowing  what  is  going  on  in  our  own  backyard”  and  “putting  our  flag  out”  to  not 
only  maintaining  its  solid  status  but  handling  the  increasing  demands  that  are 
being  placed  upon  it?  Below  I  will  discuss  three  challenges  that  GISAC  is  facing 
as  it  matures  in  being  the  cornerstone  of  Georgia’s  terrorism  prevention  efforts. 
The  first  challenge  is  of  a  strategic  nature,  the  second  an  operational  objective 
and  the  third  is  an  upcoming  event  that  involves  both  strategic  and  operational 
concerns. 

Fundamentally,  policy  makers  must  ensure  that  GISAC  is  kept  central  to 
all  terrorism  intelligence  efforts  even  as  specialized  disciplines  increase  their 
information  sharing  efforts  within  their  own  communities  of  practice.  Secondly, 
GISAC  must  identify  a  strategy  to  leverage  existing  staff  to  assist  in  performing 
investigations  when  additional  field  expertise  is  needed.  Situations  that  could 
warrant  this  type  of  staff  expansion  include  large  special  security  events  and  for 
investigating  an  actual  occurrence  of  terrorism  in  Georgia.  Finally,  I  will  discuss 
the  role  of  GISAC  in  the  upcoming  Group  of  Eight  (G8)  Conference  that  will  be 
held  in  Georgia,  June  8-10,  2004.  This  will  be  yet  another  seminal  event  for  the 
young  organization. 

1.  Keeping  GISAC  Central 

One  of  the  primary  goals  in  establishing  GISAC  was  to  ensure  that  all 
terrorism  intelligence  information  with  a  Georgia  implication  passes  through  the 
Center.  Indeed,  the  GISAC  has  become  our  clearinghouse  for  potential  terrorism 
related  information  and  intelligence.  As  has  been  demonstrated,  there  are  many 
organizations  that  have  information  to  contribute  and  must  be  included  in  the 
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collection  and  evaluation  efforts.  Since  9/1 1  and  the  establishment  of  GISAC 
there  are  many  disciplines  both  governmental  and  in  the  private  sector, 
traditional  and  non  traditional,  that  see  the  value  in  sharing  information.  This  is 
especially  true  when  the  information  warrants  evaluation  and  analysis  the  result 
of  which  could  confirm  or  dispel  a  suspicion  that  an  act  of  terrorism  is  afoot.  As 
various  disciplines  and  sectors  build  their  own  sharing  capability  it  is  paramount 
that  dual,  or  parallel  systems,  do  not  evolve.  The  potential  for  this  scenario  to 
develop  occurred  in  Georgia  when  the  agriculture  sector  expressed  a  desire  to 
create  an  Agricultural  Information  Sharing  and  Analysis  Center  (AgISAC).  To  the 
credit  of  all  involved  in  the  processes,  a  dual  system  was  not  created.  The  point 
of  the  example  is  to  show  that  as  GISAC  continues  to  be  successful  and  the 
movement  for  information  sharing  systems/centers  among  sectors  continues  to 
grow,  GISAC  will  have  to  learn  how  to  accommodate  new  customers,  process 
more  information  and  demand  to  stay  central  to  the  overall  process.  Those 
objectives  were  accomplished  by  the  role  they  have  played  in  the  development  of 
the  AgISAC  and  the  role  they  will  play  in  its  operation. 

2.  The  AgISAC 

The  entry  point  into  the  system  is  the  state’s  existing  twenty-four  hour 
communications  center  that  is  utilized  as  a  call  center  to  accept  reports  of 
suspected  agroterrorism  or  food  safety  concerns.  This  is  accomplished  by 
publicizing  a  toll-free  telephone  number  that  is  routed  to  the  communications 
center,  which  is  operated  by  GEMA.  Although  there  is  a  toll-free  telephone 
number  the  GEMA  Communications  Center  also  monitors  facsimile  machines 
and  email  emergency  notification  systems  that  could  be  the  delivery  mechanism 
for  the  report.  The  communications  officer  takes  the  report  from  the  party 
reporting  the  concerned  information.  Based  upon  pre-defined  protocols  and 
contact  information  the  communications  officer  manually  notifies  the  appropriate 
member  of  the  Executive/Threat  Assessment  Committee  that  a  report  has  been 
initiated.  The  method  of  notification  is  determined  by  the  committee  member  and 
whether  the  contact  is  made  during  duty  or  non-duty  hours.  Based  upon  the 
specificity,  urgency  and  seriousness  of  the  information  contained  in  the  report, 
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the  committee  member  decides  the  appropriate  action  to  take.  The  possibilities 
of  actions  by  the  committee  member  are  numerous  at  this  point  but,  for  purposes 
of  explaining  the  AgISAC,  it  is  important  to  note  two  developments  new  to  the 
system  in  Georgia.  First,  because  of  this  initiative,  now  there  are  pre-defined 
protocols  that  include  all  of  the  necessary  entities,  both  public  and  private, 
needed  to  conduct  a  threat  assessment,  and  secondly,  there  is  a  secure  method 
(a  secure  web  portal)  in  which  to  discuss  the  information  and  make  the 
appropriate  notifications. 

When  the  committee  member  makes  the  decision,  based  upon  the 
seriousness  and  nature  of  the  information  included  in  the  report,  to  enlist  the 
assistance  of  the  other  committee  members  is  the  point  at  which  the  Virtual  ISAC 
technology  is  employed.  The  committee  member  logs  into  the  secure  portal  that 
allows  the  member  to  post  information  to  a  bulletin  board  and  select  the  desired 
level  of  notification  needed  to  complete  the  threat  assessment.  The  notification 
will  be  delivered  via  the  secure  portal  to  the  other  committee  members,  by  the 
device  they  choose,  instructing  them  to  log  on  to  the  network  to  discuss  the 
report  and  determine  further  appropriate  actions.  The  members  of  the  threat 
assessment  committee  represent  the  GISAC  (this  includes  law  enforcement  and 
the  FBI’s  InfraGard  program),  the  Georgia  Department  of  Agriculture,  and  the 
Georgia  Department  of  Public  Health.  After  discussion  in  a  secure  environment, 
the  appropriate  disposition  is  determined  and  the  various  agencies  conduct  the 
duties  required  of  them  by  regulation  or  law.  If  further  notifications  are 
necessary,  they  are  accomplished  by  predetermined  protocols  through  the 
secure  portal  to  the  appropriate  public  and/or  private  entity.  If  some  type  of 
public  warning  is  required  that  decision  is  made  between  the  lead  agency, 
GISAC  and  the  Georgia  Office  of  Homeland  Security  and  is  performed  outside  of 
the  secure  portal  through  established  public  warning  procedures  and  methods.23 


23  The  description  of  the  system  is  based  upon  the  review  of  organizational  meeting  minutes 
and  interviews  with  Dan  Brown,  Chief  of  Communications,  GEMA. 
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The  positive  results  of  the  decision  to  explore  creating  an  AgISAC  are 
numerous.  Existing  resources,  like  the  GEMA  Communications  Center  and  the 
GISAC,  are  being  utilized  which  is  economically  and  operationally  sound. 
Responsibilities  and  expectations  between  the  public  and  private  sectors,  as  well 
as  between  governmental  agencies  not  normally  accustomed  to  emergency 
response  operations,  were  made  clear  by  the  development  of  duties  and 
protocols.  The  high  level,  experienced  personnel  necessary  to  make  appropriate 
determinations  regarding  complex  issues  are  being  allowed  to  participate,  from 
anywhere  at  anytime,  on  the  front  line  thanks  to  a  technological  solution.  And 
ultimately  the  most  positive  result  is  that  the  public  is  safer  because  steps  are 
being  taken  to  ensure  that  the  food  supply  remains  as  safe  as  possible. 

As  the  demand  for  information  sharing  and  analysis  increases  to  include  a 
myriad  of  disparate  sectors  GISAC  must  remain  central  to  the  process.  The  role 
it  plays  in  the  coordination,  awareness  and  potential  fusing  of  various  pieces  of 
information  is  the  fundamental  principle  of  the  Center.  The  evaluation  of  the 
information  must  be  performed  by  the  sector  specific  experts  but  the  fusion  and 
clearinghouse  function  must  be  maintained  by  the  GISAC.  In  the  early  stages  of 
GISAC  this  technical  function  of  evaluating  sector  specific  information  was 
achieved  solely  by  the  “adjunct”  staff  members.  Now  as  the  sectors  are  building 
their  capacity  for  sharing  the  future  will  see  more  sector  specific  ISACs  develop 
as  in  evidenced  by  the  creation  of  the  AgISAC.  The  example  set  with  this  first 
“addendum  ISAC”  must  be  followed  in  subsequent  ISACs,  which  will  surely  be 
established,  in  order  to  prevent  dual  efforts  and  creating  a  disjointed  system. 

3.  Supplemental  Staff 

Notwithstanding  any  argument  as  to  whether  or  not  the  current  staffing 
level  is  adequate  for  their  daily  mission,  without  additional  staff  GISAC  cannot 
adequately  function  in  a  special  security  event  or  in  the  event  of  an  act  of 
terrorism  in  Georgia.  As  previously  mentioned  the  Agent  in  Charge  of  GISAC 
has  the  authority  to  task  any  agent  of  the  GBI  in  the  furtherance  of  an 
investigation  suspected  to  be  terrorism  related.  This  is  true  regarding  the 
collection  of  information,  interviews  or  other  investigatory  techniques.  The 
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problem  is  that  this  authority  is  primarily  reserved  for  time  sensitive  matters  when 
a  trained  GISAC  agent  cannot  respond  in  a  timely  manner  to  accomplish  what 
needs  to  be  accomplished.  Further,  these  GBI  field  agents  have  their  own 
responsibilities  and  cannot  afford  to  get  involved  in  a  lengthy  investigation  that 
would  compromise  the  integrity  of  the  cases  for  which  they  are  responsible. 
Recognizing  the  need  for  a  plan  to  supplement  the  staff  of  GISAC  with  trained 
law  enforcement  officers,  GBI  Director  Vernon  Keenan  formulated  a  plan  that  will 
accomplish  that  goal. 

The  Strategic  Tactical  Antiterrorism  Response  (STAR)  program  is  the 
combination  of  a  training  program  and  mutual  aid  agreement  between  the  GBI 
and  the  Multi-jurisdictional  Drug  Task  Forces  in  Georgia.  These  task  forces  are  a 
combination  of  local  and  state  law  enforcement  organizations  that  enforce  illegal 
drug  laws  in  the  state.  In  other  words  they  are  undercover  drug  agents.  There 
are  31  of  these  task  forces  and  they  have  an  operational  area  of  92  of  the  159 
counties  in  Georgia.  There  are  over  300  sworn,  trained  officers  who  work  in 
these  units  on  a  full  time  basis.  These  individuals  are  perfectly  suited  for  fulfilling 
a  supplemental  staffing  role  for  GISAC  in  that  they  are  already  specially  trained 
for  complex  investigative  work,  can  work  undercover  to  provide  human 
intelligence  when  needed  and  are  geographically  dispersed  throughout  the  state. 
Many  of  the  task  forces  already  utilize  the  GBI’s  case  management  system,  have 
access  to  certain  information  systems  and  are  familiar  with  many  of  the 
investigative  and  analytical  functions  utilized  by  GISAC  described  earlier  in  this 
paper  like  the  many  charting  and  analysis  products. 

There  is  little  that  remains  to  be  done  for  the  STAR  program  concept  to 
become  a  reality.  Each  officer  will  attend  a  specially  developed  training  course 
taught  by  the  GISAC  staff  that  will,  in  effect,  teach  them  how  to  convert  their  skills 
in  criminal  intelligence  and  investigation  to  that  of  terrorist  intelligence  and 
investigation.  Mutual  aid  agreements  will  be  signed  by  law  enforcement 
agencies  that  have  staff  assigned  to  the  Multi-jurisdictional  Drug  Task  Forces. 
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These  mutual  aid  agreements  will  specify  the  conditions  under  which  the  officers 
will  become  agents  of  GISAC,  the  use  and  access  to  case  management  systems 
and  data  bases,  and  legal  issues  involving  liability  and  authority. 

4.  The  2004  Group  of  Eight  (G8)  Conference 

In  July  2003  President  George  W.  Bush  announced  that  the  Group  of 
Eight  (G8)  Economic  Summit  will  be  hosted  by  the  United  States  of  America  and 
is  to  be  held  on  Sea  Island,  Georgia,  June  8-10,  2004.  Subsequent  to  that 
announcement  the  event  has  been  declared  a  National  Security  Special  Event 
(NSSE)  and  the  United  States  Secret  Service  has  been  designated  lead  federal 
agency  status. 

It  is  only  prudent  to  expect  some  level  of  protest  activity  near  the  location 
of  this  event  given  the  recent  history  of  protests  at  similar  gatherings  that 
promote  free  trade  and  the  extensive  media  attention  given  to  protest  groups 
seeking  publicity  for  their  causes.24  Some  of  these  protests  have  turned  violent 
requiring  the  supplemental  use  of  riot  squads  and  other  specialized  units  that 
mitigate  other  forms  of  civil  disobedience.  While  the  Secret  Service  will  be  the 
lead  agency  for  securing  the  Summit  on  Sea  Island,  it  is  imperative  that  local  and 
state  agencies  be  prepared  to  respond  to  collateral  activities  associated  with  this 
event.  State  and  local  resources  must  be  prepared  should  illegal  activities  occur 
outside  of  the  declared  national  security  event  and  its  associated  venues.  While 
a  coordinated  effort  must  be  maintained  it  is  important  to  note  there  are  two  very 
different  missions  regarding  the  responsibilities  of  the  Secret  Service  and  local 
and  state  authorities.  The  primary  mission  of  the  Secret  Service  is  to  protect  the 
dignitaries  and  ensure  that  the  conference  and  associated  activities  are  not 
disrupted.  The  role  of  the  state  is  to  support  the  local  governments  with  their 
primary  mission  of  ensuring  public  safety.  The  two  missions  are  not  mutually 
exclusive  but  are  very  distinct  and  are  somewhat  more  delineated  due  to  the 
geographical  setting  in  which  the  meeting  will  take  place. 


24  Brigitte  L.  Nacos,  2002.  Mass-Mediated  Terrorism:  The  Central  Role  of  the  Media  in 
Terrorism  and  Counterterrorism.  Lanham,  Maryland:  Rowman  and  Littlefield  Publishers,  p.  72. 
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Figure  3.  Sea  Island,  Georgia 


Sea  Island,  Georgia  is  an  exclusive,  privately  owned  resort  area  where 

ingress  and  egress  can  be  totally  controlled  by  human  and  physical  security 

assets.  The  security  concern  for  this  event  is  not  as  much  for  the  primary  venue 
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proper  as  it  is  for  the  surrounding  areas.  The  one  hundred  mile  coastal  area  of 
Georgia  is  comprised  of  six  counties  that  includes  three  major  population 
centers;  Savannah,  Brunswick/Sea  Island  and  Saint  Mary’s/King’s  Bay,  each 
about  fifty  miles  apart  with  Brunswick/Sea  Island  area  in  the  center.  The 
remaining  area  is  rural.  Government  public  safety  services  in  this  area,  with  the 
exception  of  Savannah,  are  modest  to  sparse  especially  considering  an  event  of 
this  magnitude.  Because  the  federal  responsibilities  for  this  event  are  to  secure 
the  various  meeting  and  activity  venues,  local  and  state  public  safety  resources 
are  responsible  for  all  areas  outside  of  the  venues.  Other  than  Sea  Island  itself 
venues  are  finite  places  where  meetings  and  activities  will  be  conducted.  A 
hotel,  for  example,  might  be  a  venue;  however  the  roads  and  public  access 
leading  to  the  venue  is  not  part  of  the  venue.  Hence,  federal  resources  will 
protect  the  venues,  state  and  local  resources  must  protect  the  surrounding  areas. 
Therefore,  information  and  intelligence  concerning  this  event  and  any  protest 
groups  planning  to  attend  the  meeting  is  of  paramount  importance. 

Because  the  state  of  Georgia  had  established  its  information  sharing  link 
to  the  federal  agencies  nearly  two  years  earlier,  with  the  creation  of  GISAC,  an 
integrated  intelligence  operation  was  almost  instantaneously  began  upon  the 
announcement  that  G8  would  be  held  in  Georgia.  Information  is  being  shared 
pre  event  and  an  integrated  Intelligence  Operation  Center  will  be  operated  during 
the  event.  Below  is  an  example  of  how  the  coordinated  efforts  of  local,  state  and 
federal  resources  are  being  utilized  to  gather  information  and  possibly  thwart  the 
planning  and  information  gathering  efforts  of  those  who  might  be  intent  upon 
disrupting  the  Summit. 

“On  December  23,  2003  ...  GISAC  received  notification  from  the  Glynn 
County  Police  Department...  regarding  a  traffic  stop  investigation  on  Saint 
Simon’s  Island.”  (Saint  Simons  Island  is  adjacent  to  Sea  Island,  the  location  for 
the  upcoming  G8  Summit.)  The  individuals  in  the  vehicle  were  thought,  by  the 
police,  “to  have  been  taking  photographs  of  various  locations  around  the  island.” 
Subsequent  to  the  vehicle  stop  officers  obtained  consent  to  search  the  vehicle 
and  found 
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numerous  electronic  items,  such  as  scanners,  cameras,  and  video 
transmission  equipment.  During  interviews  with  Glynn  County 
authorities,  [the  suspect],  a  Swiss  national,  claimed  he  was  the 
grandson  of  the  owners  of  Reuter’s  News  Agency  and  was  in  the 
U.S.  to  cover  the  G8  Summit.  Also,  during  the  interviews,  [the 
suspect]  stated  he  had  been  on  Fort  Stewart  in  Hinesville,  GA 
interviewing  several  soldiers.  The  Public  Information  Officer  for  the 
base  confirmed  this  information. 

There  was  another  individual  in  the  vehicle  with  the  suspect  who  had 
identification  showing  him  to  be  a  resident  of  Hinesville,  GA,  the  location  of  Fort 
Stewart.  “Intelligence  checks  on  both  subjects  were  negative  and  the  subjects 
were  released  after  they  were  questioned.” 

On  January  1,  2004,  the  FBI  Joint  Terrorism  Task  Force  and 
GISAC  learned  that  [the  suspect]  had  approached  two  Plant  Hatch 
Nuclear  Facility  security  guards  on  their  way  to  work  earlier  that 
date  and  asked  numerous  questions  about  the  nuclear  facility.  He 
requested  to  do  a  story  on  the  security  of  the  facility.  The  guards 
refused  to  give  him  any  information  but  obtained  his  name  from  the 
identification  and  other  paperwork  he  presented  to  them.  On 
January  2,  2004,  law  enforcement  authorities  were  informed  by 
Reuter’s  News  Service  [the  suspect]  was  in  no  way  connected  to 
their  company,  nor  was  he  related  to  the  founder  of  Reuter’s  News 
Agency. 

On  January  3,  2004,  FBI  agents  interviewed  the  suspect  and  he  again 
claimed  to  be  a  reporter  completing  “ground  work  for  a  story  on  the  G8  Summit.” 
He  was  released  after  the  interview.  The  next  day  the  suspect  was  confronted 
by  yet  another  local  police  agency  for  being  illegally  parked  at  a  restaurant.  The 
suspect  was  taken  into  custody,  fingerprinted  and  released.  As  a  result  of  the 
fingerprints  being  obtained  the  FBI  was  able  to  complete  a  criminal  history  check 
which  revealed  that  the  suspect  was  using  a  false  name  and  had  been  convicted 
of  a  felony  in  Miami,  FL.  Further  investigation  revealed  that  he  had  provided 
false  information  on  his  visa  application.  “On  January  19,  2004,  [the  suspect] 
was  arrested  by  the  FBI  in  Newport  News,  VA  on  federal  charges  of  visa 
fraud... and  is  facing  possible  deportation.”25 

25  The  information  in  this  case  study  was  taken  from  interviews  with  members  of  GISAC  and 
the  quotations  are  directly  from  the  Office  of  Homeland  Security.  Intelligence  Bulletin,  Issue  25, 
Atlanta,  Georgi,  January  2004,  p.  1. 
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Without  the  integrated  effort  of  local,  state,  private  sector  and  federal 
officials  this  type  investigation  could  not  have  occurred.  Information,  like  this,  will 
allow  intelligence  officials  to  see  trends,  predict  future  activities  and  determine  if 
sinister  plots  are  in  the  planning  stages.  Further,  intelligence  analysts  can 
establish  links  between  local  individuals  that  may  be  sympathetic  to  groups  who 
might  seek  to  cause  disruptions  during  the  Summit.  All  information  of  this  type 
contributes  to  the  ability  of  public  safety  organizations  to  adequately  prepare  for 
and  provide  a  safe  event  for  the  dignitaries  as  well  as  the  citizens  who  live  in  the 
immediate  area.  Just  like  there  are  areas  of  responsibility  for  providing  security, 
there  are  areas  of  responsibility  for  providing  information  and  intelligence.  This 
case  shows  that  there  is  indeed  a  role  for  all  levels  of  government  and  the  private 
sector  for  information  sharing  and  intelligence. 

The  role  of  Intelligence  is  to  provide  policy  makers  with  the  information 
they  need  to  make  decisions.26  As  mentioned  earlier,  the  operation  necessary  to 
support  this  NSSE  has  multiple  policy  makers  with  different  roles  in  the  event. 
Each  organization  needs  accurate,  timely  information  analyzed  with  their  mission 
considered  so  that  sound  policy  decisions  can  be  made  regarding  their  mission. 
In  the  above  case  study,  one  only  has  to  remove  any  one  of  the  contributors  to 
create  a  potential  intelligence  failure.  Neither  our  dedicated  public  safety  officials 
nor  our  country  needs  another  Intelligence  failure.  In  this  example  of  harmonious 
coordination  and  cooperation  each  entity  demonstrated  a  key  role  in  contributing 
to  the  identification  of  this  suspect  resulting  in  his  eventual  capture.  The 
intelligence  value  of  this  success,  while  significant  now,  will  not  be  fully  known 
until  subsequent  investigations  are  completed  and  until  after  the  Summit  has 
concluded.  Each  entity  not  only  has  a  contribution  to  play  in  the  intelligence 
operation  of  a  NSSE  but  also  has  requirements  they  need  filled  by  the 
intelligence  community  and  therefore  must  be  allowed  to  be  a  part  of  the 
coordinated  effort. 


26  Mark  Lowenthal,  2003.  Intelligence:  From  Secrets  to  Policy,  2nd  ed.  CQ  Press, 
Washington,  D.C.  p.  2. 
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Fortunately,  that  has  been  the  case  in  Georgia  concerning  the  intelligence 
function  for  G8.  GISAC  has  been  involved  with  the  FBI  and  the  Secret  Service 
each  step  of  the  way.  GISAC  was  included  from  the  beginning  as  the  Secret 
Service  established  the  Intelligence  Sub  Committee  and  named  GISAC  as  a  co¬ 
chair  of  the  committee.  Accordingly,  rather  than  operating  independently  there 
will  be  a  fusion  center  or  combined  intelligence  operations  center  inclusive  of  all 
agencies  when  staffs  are  moved  forward  to  work  the  event.  This  integrated 
Intelligence  Operations  Center  will  be  located  in  a  secure  area  of  the  larger  Multi¬ 
agency  Coordination  Center,  a  place  where  all  parties  will  be  commanding  their 
forces. 

H.  SUMMARY 

Only  weeks  after  9/1 1 ,  in  a  visionary  move,  the  state  of  Georgia  created 
GISAC  to  be  the  central  processing  and  collection  point  for  all  its  terrorism 
related  intelligence  information.  Public  safety  leaders  knew  that  the  enemy  had 
infiltrated  our  country  and  “we  needed  to  know  what  was  going  on  in  our  own 
backyard.”  In  the  years  since  being  established  there  are  now  obvious  reasons 
accounting  for  its  success. 

Positive,  collegial  relationships  were  maintained  and  established  with 
state,  local  and  federal  entities  that  had  a  stake  in  the  mission  of  providing  and 
sharing  information.  These  relationships  have  proven  to  be  central  to  the 
success  of  GISAC  as  evidenced  by  the  various  agencies  that  have  permanently 
assigned  personnel  to  the  Center,  the  facilities  that  have  been  made  available  for 
its  use  and  the  intelligence  successes  demonstrated  by  an  examination  of  the 
case  studies.  Another  key  to  success  is  that  the  GISAC  reports  to  the  head  of 
the  state’s  homeland  security  effort.  The  placement  within  the  organizational 
structure  of  state  government  has  survived  a  major  transition  of  political  power 
within  the  state.  This  stability  and  high  position  within  the  organizational  chart  of 
state  government  evidences  the  importance  placed  upon  the  GISAC  and  the 
state’s  commitment  to  the  unit  and  to  the  concept  of  information  sharing. 
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The  future  of  GISAC  is  filled  with  opportunities  to  grow  and  become  more 
effective.  These  opportunities  must  be  managed  appropriately  with  the  founding 
doctrines  maintained.  Accordingly,  as  new  sector  specific  ISACs  are  established 
GISAC  must  remain  central  to  the  coordination  of  all  activities.  This  coordination 
has  been  maintained  and  a  template  has  been  established  with  the  creation  of 
the  Georgia  AgISAC.  Centrality  of  coordination  efforts  are  easy  to  demand  when 
the  history  of  GISAC’s  operational  behavior  and  its  own  policies  require  the 
sharing  of  information  to  all  pertinent  entities,  both  traditional  and  nontraditional. 
This  enables  organizations  to  make  determinations  concerning  distribution  of 
intelligence  to  their  constituencies,  or  in  other  words,  they  are  partners  in 
deciding  “who  needs  to  know”. 

The  future  for  GISAC  will  also  have  it  playing  a  major  role  in  the 
preparation  and  planning  for  special  events.  One  such  event  is  the  upcoming  G8 
Summit  that  will  be  held  in  Georgia  in  June  2004.  Already  GISAC  has  been  a 
key  component  to  the  intelligence  efforts  for  this  high  profile  event.  Even  though 
the  event  has  been  declared  a  NSSE  and  the  Secret  Service  is  the  lead  federal 
agency,  GISAC  has  been  central  to  the  intelligence  planning  and  operations. 
Already  suspicious  activities  concerning  the  Summit  has  been  reported  through 
the  GISAC  system  and  in  one  particular  case  an  individual  has  been  arrested 
and  is  facing  deportation  for  fraudulent  information  given  on  his  visa.  The  model 
of  fusing  information  between  federal,  state,  local  and  private  sector  resources 
prior  to  an  event  will  be  field  deployed  and  utilized  during  this  event  by 
establishing  a  joint  intelligence  operations  center  near  the  site  of  the  Summit. 

GISAC  is  central  to  the  terrorism  prevention  efforts  of  the  state  of  Georgia. 
The  success  that  it  has  enjoyed  is  the  result  of  innovation,  the  initial  political 
support  given  and  maintained,  and  sound  organizational  doctrines.  These 
principles  must  be  maintained  to  ensure  future  successes  for  not  only  GISAC  but 
for  our  country  in  its  war  on  terrorism.  Our  country  does  not  need  another 
Intelligence  failure  and  we  must  do  everything  in  our  power  to  keep  that  from 
occurring  again.  The  contribution  of  state  and  local  efforts  to  the  intelligence 
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community  is  a  huge  step  in  preventing  those  potential  future  failures.  While  the 
inclusion  of  these  efforts  will  not  guarantee  another  failure  from  occurring  their 
exclusion  from  the  effort  will  most  probably  guarantee  that  it  will. 
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IV.  CONCLUSION 


The  purpose  of  this  thesis  is  to  show  that  state  and  local  governments 
have  a  key  role  to  play  in  the  intelligence  community  and  that  inclusion  is 
mutually  beneficial  to  all  levels  of  government.  While  proving  that  hypothesis  is 
not  extremely  difficult  (nowadays)  the  proof  would  be  useless  without  a  solution. 
The  other  reasons  for  this  thesis  are  to  offer  solutions.  Those  solutions  include 
the  requirements  analysis  of  a  successful  state  intelligence  effort  and  the 
important  organizational  concepts  for  establishing  a  state  ISAC. 

While  there  are  both  domestic  and  internationally  based  terrorist  groups 
who  have  successfully  committed  acts  of  terrorism  in  the  United  States,  the 
events  of  9/1 1  have  changed  many  things  about  life  in  America.  One  of  those 
changes  is  the  requirement  that  government  leaders  have  accurate  and  timely 
intelligence  information.  Without  the  inclusion  of  state  and  local  efforts  in  the 
intelligence  community  that  requirement  will  not  be  met.  For  it  is  in  the  local 
communities  that  the  terrorists  are  living,  preparing  and  planning  for  their  next 
attack. 

The  terrorist  attacks  on  September  11,  2001,  seemed  to  initiate  the 
United  States  into  the  full  horrors  of  international  terrorism.  Yet  the 
country  is  no  stranger  to  terrorism.  Since  1950  there  have  been 
over  3000  terrorist  attacks,  ranging  from  the  Ku  Klux  Klan’s 
campaign  of  terror  against  the  civil  rights  movement,  through  the 
waves  of  attacks  by  neo-Nazi  and  militia  groups  to  the  activities  of 
Osama  bin  Laden’s  al  Qaeda  network.27 

The  supporting  research  and  case  studies  throughout  this  thesis  show  the 
need  to  include  local  and  state  intelligence  efforts  is  mutually  beneficial  to  all 
levels  of  government.  Whether  the  information  benefits  the  military  by  exposing 
someone  with  dual  credentials  or  the  Bureau  of  Immigrations  and  Customs 
Enforcement  by  discovering  illegal  visitors  attempting  to  obtain  information  about 
the  G8  Summit,  locally  produced  information  benefits  all  involved.  When  states 

27  Christopher  Hewitt.  Understanding  Terrorism  in  America.  Routledge,  2003.  Introductory 
Page. 


53 


develop  single  points  of  contact  for  the  analysis  and  sharing  of  information, 
intelligence  can  be  passed  along  to  federal  authorities  who  can  “connect  the 
dots”  with  similar  efforts  from  other  states’  to  ensure  that  the  information  and 
intelligence  does  not  stop  at  the  state  line.  This  is  truly  a  federal  system, 
comprised  of  all  of  the  states,  versus  a  national  system.  This  state-included 
federal  system  will  add  hundreds  of  thousands  of  eyes  and  ears  in  the  field  to 
detect  terrorists  living  in  our  hometowns. 

While  the  states  contribute  significantly  to  the  established  intelligence 
community  by  passing  “up”  bits  and  pieces  of  information  from  hundreds  of 
thousands  of  local  officials  to  form  tactical  level  intelligence.  States  and  local 
governments  benefit  from  the  intelligence  community  by  the  strategic  level 
intelligence  that  is  passed  “down”  regarding  the  capacity  of  especially  foreign 
based  organizations.  Local  and  state  governments  do  not  have  foreign  spies, 
special  military  units,  or  satellites  to  provide  them  intelligence  of  that  nature. 
They  must  rely  on  the  assets  of  the  federal  government  to  provide  that  type  of 
information.  That  information  is  very  important,  however,  as  state  policy  makers 
have  significant  decisions  to  make  in  committing  precious  prevention  and 
preparedness  funds.  Those  decisions  must  be  made  with  the  most  robust 
information  available  about  the  enemy(s).  Why  prepare  for  a  specific  type  of 
attack  if  your  enemy  does  not  possess  that  capability?  Conversely,  one  had 
better  prepare  for  the  attack  that  your  enemy  is  capable  of  initiating  and  one  had 
better  know  that  capability  exists.  Strategic  intelligence  is  necessary  for  state 
and  local  policy  makers. 

The  state  of  Georgia  quickly  and  aggressively  embraced  the  challenges 

presented  by  the  horrific  attacks  of  9/1 1  and  the  realization  that  the  intelligence 

community  had  failed.  Public  safety  officials  understood  that  part  of  the  remedy 

for  that  failure  was  to  develop  and  add  state  level  intelligence  efforts  to  the 

existing  intelligence  community.  The  omission  of  state  and  local  efforts  occurred 

a  generation  earlier  when  the  intelligence  community  in  America  was  created  but 

now  was  the  time  to  change  that  omission.  These  attacks  and  the  ensuing 

political  reaction  indicated  that  the  strategy  of  using  terrorism  in  the  homeland 
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had  reached  a  new  level.  The  enemy  seemed  more  organized,  more  capable 
and  more  resolute.  Prior  to  receiving  national  guidance  and  before  the  publishing 
of  the  National  Strategy  for  Homeland  Security  public  safety  leaders  in  Georgia 
established  the  Georgia  Information  Sharing  and  Analysis  Center.  Initially  the 
reason  was  obvious;  foreign  terrorists  had  infiltrated  our  country,  were  living  in 
our  communities  and  it  was  the  responsibility  of  those  in  local  and  state 
government  to  do  their  part  in  locating  them  and  preventing  future  attacks.  While 
the  attacks  of  9/1 1  and  the  impact  of  international  terrorists  were  the  impetus  for 
the  creation  of  GISAC  this  newly  formed  unit  would  be  effective  in  fighting 
domestic  terrorists  as  well. 

GISAC  was  formed  on  October  21,  2001  and  was  housed  in  the  same 
building  as  the  state’s  emergency  operations  center.  Immediately,  the  newly 
created  unit  began  investigating  and  developing  information  on  activities  and 
individuals  that  may  possibly  be  involved  in  terrorism.  Crucial  to  the  success  of 
any  effort  of  this  type  was  the  need  to  establish  a  relationship,  or  link,  to  the 
federal  intelligence  community.  This  was  done  by  approaching  the  FBI  through 
the  Joint  Terrorism  Task  Force  located  in  Atlanta,  Georgia.  Investigators  with  the 
Georgia  Bureau  of  Investigation  led  the  effort  to  create  GISAC  and  had  a  working 
relationship  with  the  FBI  through  works  of  mutual  interest  in  the  criminal 
investigation  arena. 

From  the  first  days  of  its  existence,  GISAC  began  investigating  leads  and 
developing  information  on  potential  domestic  and  international  terrorist  activities 
in  and  around  the  state  of  Georgia.  Those  investigations  have  ranged  from 
merely  performing  rumor  control  activities  and  passing  “up”  information  that  no 
one  will  ever  know  whether  or  not  the  information  made  a  difference  (like  the  call 
from  the  Georgia  Department  of  Agriculture  regarding  an  over  anxious,  over 
qualified  Middle  Eastern  job  applicant),  to  people  who  were  deported  due  to 
fictitious  travel  visas.  Regardless  of  the  outcome  of  the  investigations  performed, 
GISAC  has  remained  central  to  Georgia’s  prevention  efforts.  Through  those 
efforts  many  lessons  have  been  learned  about  what  is  important  for  state 
information  and  sharing  efforts. 
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The  Alligator  Alley  case  study  revealed  that  almost  all  information 
originates  locally.  Further,  a  lesson  learned  is  that  all  states  need  to  develop  a 
central  point  of  contact  to  facilitate  the  gathering  of  information  in  a  terrorism 
investigation.  Events  and  situations  develop  and  move  quickly  and  states  need 
to  have  a  unit  of  government  (preferably  an  ISAC)  to  navigate  their  own  state’s 
bureaucracy  on  behalf  of  the  state  requesting  investigative  or  antiterrorism 
information.  Again,  relationships  are  very  important  in  this  type  of  work  and  must 
be  established  to  ensure  that  information  flows  properly.  Additionally,  states 
need  to  have  a  single  point  of  contact  in  the  federal  system  to  navigate  that 
bureaucracy  and  to  check  suspects  against  various  databases  and  watch  lists. 
The  final  point  that  Alligator  Alley  showed  is  that  the  state  ISAC  must  be  broader 
than  just  law  enforcement.  This  case  study  was  extended  somewhat  and 
included  some  “what  if”  questions.  The  answers  to  those  questions  and  the 
policies  in  place  at  GISAC  substantiate  the  need  for  numerous  subject  matter 
experts  and  critical  facility  representatives  included  as  staff  members,  “trusted 
partners”,  or  adjunct  staff  to  the  ISAC.  In  today’s  environment  law  enforcement 
alone  cannot  possess  the  breadth  of  knowledge  it  takes  to  analyze  all  information 
and  make  accurate  threat  assessments  on  the  myriad  threats  that  exist.  The  list 
of  expertise  needed  is  voluminous  but  a  few  examples  are  biological,  cyber, 
agricultural,  radiological  and  the  various  critical  infrastructure  sectors. 

Finally,  an  examination  of  the  case  studies  and  the  lessons  learned  during 
GISAC’s  two  and  one  half  years  in  operation  has  revealed  some  fundamental 
principles  that  should  be  considered  by  other  states  following  this  model.  First, 
the  non-law  enforcement  staff  members  must  have  access  to  all  information  in 
order  to  render  threat  assessments  upon  that  information.  Only  those  expert  in 
their  field  can  make  a  credible  determination  relative  to  their  discipline  or  their 
sector  of  critical  infrastructure.  Second,  the  agent  in  charge  (or  head)  of  the 
ISAC  must  have  unobstructed  access  to  the  head  of  that  jurisdictions’  Homeland 
Security  top  official.  There  are  many  reasons  for  this  access  but  none  greater 
than  the  potential  necessity  to  issue  an  alert  or  warning  relative  to  intelligence 
information.  Third,  as  success  occurs  and  others  are  want  to  develop  their  own 
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ISAC  (developing  sector  specific  ISACs  is  consistent  with  the  National  Strategy 
for  Homeland  Security)  the  state  level  ISAC  must  remain  as  the  central,  or  main, 
hub  of  all  intelligence  information  for  that  state  regardless  of  the  discipline  or 
sector.  Forth,  the  ISAC  must  generate  intelligence  products  for  customers  to 
include  local  and  state  public  safety  policy  makers  so  that  policy  makers  have  the 
information  they  need  to  make  sound  funding,  operational  and  preparedness 
decisions.  GISAC  publishes  weekly  and  monthly,  classified  and  non  classified 
reports  that  are  distributed  to  various  constituencies.  Additionally,  they  have 
developed  robust  investigative  and  analysis  support  tools  to  assist  customers 
with  terrorism  related  investigations  and  developing  intelligence.  Finally,  to 
ensure  success  in  information  sharing,  analysis  and  investigations  and  ISAC 
must  have  a  plan  to  expand  its  staff  quickly  to  meet  the  challenges  faced  today. 
GISAC  has  two  ways  in  which  to  expand  its  staff.  First,  the  management  of  the 
unit  has  the  authority,  given  by  the  Director  of  the  GBI,  to  task  any  GBI  agent  in 
the  state  in  the  furtherance  of  developing  intelligence  information  or  during  a 
terrorism  related  investigation.  This  authority  is  especially  critical  given  the 
statewide  jurisdiction  of  GISAC  and  that  all  employees  are  assigned  to  a  central 
office.  Often,  quickly  developing  information  is  reported  by  local  authorities 
located  hours  away  from  GISAC  offices.  In  these  circumstances,  a  locally 
assigned  GBI  agent  is  dispatched  to  the  scene  to  conduct  an  interview  or 
otherwise  assist  with  an  investigation  and  the  information  is  forwarded  to  GISAC. 
Secondly,  GISAC  and  the  GBI  are  developing  a  program  called  STAR  (Strategic 
Tactical  Antiterrorism  Response)  to  increase  further  the  numbers  of 
supplemental  staff  available  for  state  intelligence  investigations.  This  program 
will  ensure  that  sufficient  numbers  of  specifically  trained  investigators  can  be 
dispatched  in  a  terrorism  related  investigation  as  adjuncts  to  the  full  time  GISAC. 

The  intelligence  community  was  created  a  generation  prior  to  9/1 1  and 
was  primarily  designed  to  ensure  that  the  United  States  was  not  the  victim  of  a 
surprise  attack  or  an  attack  with  an  unanticipated  weapon.  Sure,  there  were 
other  capabilities  and  objectives  of  the  intelligence  community  but  that  was  its 
foundation.  Through  the  years  the  environment  has  changed  and  as  domestic 

57 


and  foreign  terrorists,  who  would  harm  America,  grew  in  numbers  and  capability 
the  intelligence  community  did  not  adapt.  There  may  have  been  valid  and 
credible  reasons  for  not  changing  the  system  but  now  that  must  change.  In  order 
to  increase  the  chances  of  preventing  future  attacks,  with  either  domestic  or 
internationally  based  groups,  state  and  local  law  enforcement  must  be  allowed 
ingress  and  egress  into  the  intelligence  community.  Although  many  attacks  have 
occurred  before  9/1 1  the  attacks  on  that  day  have  been  the  most  tragic  to  thus 
far.  The  time  is  right  to  make  a  major  change  in  the  system.  The  change  that 
needs  to  be  made  is  to  reengineer  the  intelligence  community  to  include  state 
and  local  governments  as  a  full  partner  in  the  fight  against  terrorism  at  home. 
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